🔍 Read the full analysis: Google Takes Down TV Box Botnet Linked To Malware From The Factory on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Google and industry partners disrupted the control infrastructure for the XCPE botnet, which Google says affected more than 1.3 million set-top boxes. Google attributes the firmware backdoor to manufacturer Videostrong, but the company has not responded to media requests cited in the source report. The takedown cuts off remote control; it does not remove malware embedded in affected devices.
Google said it and its partners disrupted the control infrastructure of XCPE, a botnet linked to malware embedded in Android TV boxes before they reached customers. The company says the network involved more than 1.3 million set-top boxes and that Shenzhen-based manufacturer Videostrong Technology Co. developed and operated the backdoor for financial gain. The takedown limits the operators’ remote access, but does not remove the malware from affected devices.
Google’s Threat Intelligence Group (GTIG) announced the operation on Nov. 2, saying it worked with Japan’s National Police Agency and security firms Lumen, HUMAN Security, Plume, Synthient and TrendAI. Google said legal action targeted domains and servers used to control XCPE and distribute malware. It also said it took action against control servers for more than a dozen malware families that had been installed on boxes as add-ons.
TrendAI counted 1,472,554 infected devices between June 3 and Oct. 1, 2026, describing that figure as a lower bound. Google’s broader estimate of more than 1.3 million devices refers to the botnet’s set-top boxes. Google also estimates that shutting down servers for the additional malware families could cut off access to at least 10 million more compromised devices. That is an estimate, not a verified device count, and the source report says those devices do not all run Android.
GTIG says the boxes were used mainly as residential proxies, routing other people’s internet traffic through owners’ connections, and for ad fraud. Google also reported operators could install apps, run commands, capture screens, collect account and device information, and open remote shells. Those capabilities describe what the malware enabled; the report does not establish that every capability was used on every infected box.
Infographic 01 · XCPE in numbers
A botnet that shipped from the factory
Google says the device maker Videostrong built the backdoor into its own firmware and sold access. That is Google’s assessment; Videostrong did not respond to the press.
set-top boxes in the XCPE botnet, the joint figure of Google and its partners. Taken down in late October 2026.
- 1,472,554 infected devices in TrendAI’s own telemetry, 3 Jun to 1 Oct 2026, a lower bound.
- Partner counts differ by snapshot and view, so the joint figure is “more than 1.3 million”.
- 10M+ more devices lost their malware’s control servers: Google’s estimate, not a count.
How one box earns money for criminals
- Built inA system app sits in the firmware and reinstalls itself after a reboot
- Phones homeOn start it fetches settings and keeps a line open to a control server
- Sold onAccess is sold to partners, who push their own modules
- Cashed inResidential proxy, hidden ad views, more backdoors
Your home internet address is the product. Strangers rent it, and their traffic looks as if it came from your living room.
Sources: Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026. Simplified for readers; no indicators or technical details reproduced.
Powered by Thorsten Meyer AI
Risks for TV Box Owners
The case puts the risk at the manufacturing and firmware level, rather than relying only on users downloading a malicious app. If the backdoor is built into a device’s system software, ordinary steps such as uninstalling an app may not remove it. Google says the malware can return after a reboot because it reinstalls from a protected partition.
Compromised home devices can also be used as infrastructure for activity that appears to come from their owners’ internet connections. That can expose households and businesses to unwanted traffic and make a device part of criminal operations without its owner’s knowledge. Google’s report also says some affected devices were Google-certified, raising questions about how firmware checks can be bypassed and what certification can guarantee.
For organizations, the incident is a reminder that connected devices outside the traditional computer fleet can still create security risks. A familiar or local-looking IP address is not proof that traffic is benign when a residential proxy may be involved. The source report recommends treating suspicious boxes as untrusted and keeping TV devices on a separate network where possible.
Products Worth Considering
Amazon Kindle Scribe (64GB) with Premium Pen, Metallic Jade
Amazon Kindle Paperwhite (2024), 16 GB, 7-inch Display, Black
LG UltraGear 27GX704A-B 27-inch QHD OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How the Firmware Backdoor Worked
Google describes the backdoor as a system app called x.cpe in some device builds and com.oemservice in others. It had system-level permissions and contacted a control server after startup. According to GTIG, removing the app did not solve the problem: a protected firmware partition could restore it when the box rebooted.
The malware’s design separated the component that contacted the server from a loader and the modules used to make money. Google says the system had at least three layers by late 2024. In August 2026, GTIG observed new droppers disguised as Android system apps replacing the loader, which the group interpreted as an effort to remain hidden.
Google said Videostrong used obfuscation to get malicious code past certification checks by loading it after the device’s first boot. Google has barred Videostrong and any future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors. It also said it changed its firmware-integrity review process for certified Android TV devices.
““The backdoor and the botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group
What the Takedown Did Not Remove
The disruption targeted control servers and domains; it did not, according to the source material, clean the firmware on affected boxes. Google’s report says the backdoor can reinstall after a reboot, so the source article advises owners to treat a suspected device as untrusted, unplug it or replace it, and avoid assuming an app uninstall is enough. The material does not provide a complete list of affected models or a consumer-facing method to confirm infection on every device.
Google says it has high confidence in its attribution to Videostrong. The manufacturer did not respond to requests for comment from The Record and heise, according to the source report. The source also says Google did not publish the court filing and that no public case record was found by its author, leaving the specific court and case number unavailable. The full scope of the estimated additional 10 million affected devices is also not independently established in the material.
Firmware Checks and Owner Steps
Google says it has tightened firmware-integrity checks for certified Android TV devices and barred Videostrong from future participation in its certified-device program. The company has not, in the supplied material, set out a public timetable for those changes or detailed how owners can identify every affected model.
Owners can check whether a box is Play Protect certified and be cautious with no-name or “unlocked” devices, but certification alone should not be treated as a guarantee against this kind of threat. For a box suspected of infection, the source report recommends disconnecting or replacing it and placing TV boxes on a separate guest network. Businesses should review connected home and office devices as part of their security exposure, rather than relying only on IP reputation to judge traffic.
Further details may emerge from Google, its partners or law enforcement about affected brands, devices and legal proceedings. Until then, the confirmed practical limit of the operation is that the operators’ control infrastructure was disrupted; the supplied reporting does not say that infected boxes were remotely cleaned.
Key Questions
What is the XCPE botnet?
XCPE is a network of Android TV boxes that Google says were compromised by a firmware backdoor and connected to remote control servers. Google said the botnet involved more than 1.3 million set-top boxes.
Who does Google say was behind the malware?
Google’s Threat Intelligence Group attributes the backdoor’s development and operation to Videostrong Technology Co., a Shenzhen-based device maker. That is Google’s assessment; Videostrong did not respond to media requests cited in the source report.
Does the takedown remove malware from an infected TV box?
No. The operation disrupted the botnet’s control infrastructure, but the source material says the backdoor remains in firmware and can reinstall after a reboot. Uninstalling the app may not remove it.
What could the infected boxes do?
Google says they were used mainly as residential proxies and for ad fraud. The malware also gave operators capabilities including installing apps, running commands, capturing screens and collecting device or account data; the report does not say every capability was used on every box.
What should owners do if they suspect their box is affected?
The source report advises treating a suspected device as untrusted: disconnect or replace it, and keep TV boxes on a separate guest network where possible. Owners can check Play Protect certification, but the supplied material does not provide a complete list of affected models or a definitive infection-checking tool.
Source: ThorstenMeyerAI.com
