🔍 Read the full analysis: Google’s TV Box Botnet Takedown: 1.3 Million Devices And Factory Malware on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Google and industry partners disrupted the control infrastructure for XCPE, a botnet affecting more than 1.3 million set-top boxes, according to Google and TrendAI. Google attributes the firmware backdoor to manufacturer Videostrong, but the malware may remain on affected devices after the takedown.
Google’s Threat Intelligence Group says it and industry partners disrupted the control infrastructure for XCPE, a botnet linked to more than 1.3 million set-top boxes, in late October. Google alleges with high confidence that device maker Videostrong Technology Co. built and operated a backdoor embedded in the boxes’ firmware, allowing them to be used for residential proxy services, ad fraud and other remote activity.
In a report published November 2, Google said it worked with Japan’s National Police Agency and security companies to take legal action against domains and servers used to control XCPE and distribute malware. Google also said it pursued control servers for more than a dozen malware families installed on the boxes as add-ons. Its response included banning Videostrong and future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors, as well as tightening firmware integrity checks for certified Android TV devices.
Google described the backdoor as a system app, identified in some versions as x.cpe or com.oemservice, with system-level privileges. The report says the malware contacted a control server after startup and could receive instructions to install apps, run commands, capture screens and scan local networks. Google also said the backdoor could restore itself from a protected partition after a reboot if removed, meaning an ordinary app uninstall would not necessarily eliminate it.
TrendAI counted 1,472,554 infected devices between June 3 and October 1, 2026, and described its figure as a lower bound. Google separately said the takedown could cut off access to at least 10 million additional compromised devices affected by malware distributed through other channels. That larger number is Google’s estimate, not a confirmed count; reporting cited in the source material says those devices do not all run Android.
Infographic 01 · XCPE in numbers
A botnet that shipped from the factory
Google says the device maker Videostrong built the backdoor into its own firmware and sold access. That is Google’s assessment; Videostrong did not respond to the press.
set-top boxes in the XCPE botnet, the joint figure of Google and its partners. Taken down in late October 2026.
- 1,472,554 infected devices in TrendAI’s own telemetry, 3 Jun to 1 Oct 2026, a lower bound.
- Partner counts differ by snapshot and view, so the joint figure is “more than 1.3 million”.
- 10M+ more devices lost their malware’s control servers: Google’s estimate, not a count.
How one box earns money for criminals
- Built inA system app sits in the firmware and reinstalls itself after a reboot
- Phones homeOn start it fetches settings and keeps a line open to a control server
- Sold onAccess is sold to partners, who push their own modules
- Cashed inResidential proxy, hidden ad views, more backdoors
Your home internet address is the product. Strangers rent it, and their traffic looks as if it came from your living room.
Sources: Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026. Simplified for readers; no indicators or technical details reproduced.
Powered by Thorsten Meyer AI
The Risks Inside Certified TV Boxes
The case matters because the alleged infection route differs from a typical malicious download: Google says the backdoor was placed in device firmware before the boxes reached buyers. That can leave users with little practical way to identify or remove the malware, particularly if it returns after a reboot. Google also said some affected devices were Google-certified, raising questions about how malicious code passed through certification checks.
According to Google, infected boxes were mainly used as residential proxies and for ad fraud. A proxy can route another party’s traffic through a household’s internet connection, making activity appear to come from that connection. Google also reported capabilities including remote commands and screen capture. The report does not establish that every infected box was used for every listed purpose, or that any particular owner’s accounts were accessed.
The disruption may reduce operators’ ability to control the botnet, but it does not amount to a confirmed cleanup of devices already sold. Consumers and organizations with these boxes may need to treat them as untrusted network equipment, rather than assuming the takedown has removed the underlying software.
Popular right now
TCL 65-Inch T7 Series 4K QLED Smart Google TV, 144Hz (65T7)
Sony BRAVIA XR8B 65-Inch 4K OLED Google TV (K-65XR8B)
TCL 65 Inch QM8L Series SQD-Mini LED QLED 4K Smart Google TV
As an affiliate, we earn on qualifying purchases.
How the Backdoor Reached Devices
Google’s report says the XCPE operation used a backdoor built into firmware by Videostrong, a manufacturer that produces devices for its own brands and for other companies. Google said the code was loaded after a device’s first boot, a method it says helped it evade certification checks. The report describes the backdoor as the persistent access point, with additional malware modules supplied by affiliates.
Google said the operation’s design had included several layers since at least late 2024. In August 2026, it observed new droppers disguised as Android system apps replacing the loader, which Google interpreted as an effort to remain concealed. The company’s November 2 report, titled “Shutting the Door on the XCPE Botnet,” names the National Police Agency of Japan and security firms Lumen, HUMAN Security, Plume, Synthient and TrendAI as partners.
The source material says Google did not publish the court filing for its legal actions, and no public case record or case number was identified. The legal steps are described by Google, but the available material does not provide court documents through which readers can independently review the claims.
““The backdoor and the botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group
What the Takedown Did Not Remove
The available information does not show how many of the 1.3 million-plus devices remain online, how many are still infected, or how many owners have been notified. Google’s account says the backdoor can survive an app removal and return after a reboot; it does not say the server disruption itself removes firmware malware from devices.
Google’s estimate of at least 10 million additional compromised devices is not a verified device-by-device tally, and the source material says the affected systems are not all Android. The material also does not include public court filings, Videostrong’s response, or a detailed list of every affected model and brand. The manufacturer did not respond to requests for comment from The Record and heise, according to the source article.
Device Checks and Google’s Follow-Up
Google said it has changed its review process for certified Android TV firmware and barred Videostrong and related future entities from supplying certified devices or software. The company has not provided a public timeline or detailed technical description of the revised checks in the source material. The effectiveness of those changes will be clearer as the new review process is applied to future devices.
Owners can check whether a box is Play Protect certified and be cautious about no-name or “unlocked” devices, but certification alone cannot establish that an older box is clean. The source material recommends unplugging or replacing a suspicious device and keeping TV boxes on a separate guest network. Businesses should also account for home and office connected devices in security planning and avoid relying solely on IP reputation, since proxy traffic can appear to come from ordinary residential connections.
Further detail may emerge if court records or manufacturer responses become public. Until then, the confirmed development is the disruption of control infrastructure and Google’s announced certification changes; the condition of individual devices and the full reach of the related malware remain unresolved.
Key Questions
What happened to the XCPE botnet?
Google says it and industry partners disrupted XCPE’s control infrastructure in late October 2026. Google announced the action on November 2, saying the botnet was linked to more than 1.3 million set-top boxes.
Who does Google say was behind the firmware backdoor?
Google alleges with high confidence that Videostrong Technology Co. built and operated the backdoor for financial gain. The source material says Videostrong did not respond to requests for comment from The Record and heise, and it does not provide public court filings.
Does the takedown remove malware from an affected TV box?
Not necessarily. Google says the backdoor can reinstall itself after a reboot from a protected partition, so removing an app may not remove the underlying firmware malware. The source material does not say that cutting off the control servers cleans infected devices.
How many devices were affected?
Google reported more than 1.3 million set-top boxes. TrendAI counted 1,472,554 infected devices between June 3 and October 1, 2026, and called that a lower bound. Google’s separate estimate of at least 10 million additional compromised devices concerns malware distributed through other channels, not a confirmed count of XCPE boxes.
What should owners do if they suspect their box is affected?
The source material recommends checking Play Protect certification, treating a suspicious box as untrusted, unplugging or replacing it, and placing TV boxes on a separate guest network. Certification status does not by itself confirm that a device is free of malware.
Source: ThorstenMeyerAI.com
