🔍 Read the full analysis: Inside The TV Box Botnet: Malware Traced To The Factory on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Google said on Nov. 2 that Videostrong Technology built and operated the XCPE botnet by embedding a backdoor in Android TV box firmware. Google and partners disrupted the botnet’s control infrastructure in late October, but the backdoor remains on affected devices and can reinstall after a reboot.
Google said on Nov. 2 that Shenzhen-based device maker Videostrong Technology intentionally built and operated a backdoor in Android TV box firmware, creating the XCPE botnet, which affected more than 1.3 million set-top boxes. Google and industry partners disrupted the botnet’s control infrastructure in late October, but the company says the backdoor remains in infected devices and can reinstall after a reboot.
Google’s Threat Intelligence Group said it worked with industry partners and Japan’s National Police Agency to disrupt the botnet. The operation included legal action to take down domains and servers used to control XCPE and distribute malware add-ons, along with action against control servers for more than a dozen malware families found on the boxes. Google also barred Videostrong and its future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors, and said it tightened firmware integrity checks.
The scale figures come from different sources and should not be treated as identical measurements. Google described XCPE as involving more than 1.3 million set-top boxes. Partner TrendAI counted 1,472,554 infected devices from June 3 to Oct. 1, 2026, and characterized that figure as a lower bound. Google also estimated that disabling control servers for add-on malware could cut access to at least 10 million additional compromised devices. That is an estimate, not a confirmed device count, and those devices do not all necessarily run Android.
Google said the boxes were used mainly as residential proxies, routing other people’s internet traffic through owners’ connections, and for ad fraud. Its report also describes operators taking screenshots, injecting keystrokes, collecting account and device information, opening remote shells and scanning local networks. Google says some affected boxes were Google-certified; it attributed their passage through certification checks to code that loaded after the devices’ first boot.
Infographic 01 · XCPE in numbers
A botnet that shipped from the factory
Google says the device maker Videostrong built the backdoor into its own firmware and sold access. That is Google’s assessment; Videostrong did not respond to the press.
set-top boxes in the XCPE botnet, the joint figure of Google and its partners. Taken down in late October 2026.
- 1,472,554 infected devices in TrendAI’s own telemetry, 3 Jun to 1 Oct 2026, a lower bound.
- Partner counts differ by snapshot and view, so the joint figure is “more than 1.3 million”.
- 10M+ more devices lost their malware’s control servers: Google’s estimate, not a count.
How one box earns money for criminals
- Built inA system app sits in the firmware and reinstalls itself after a reboot
- Phones homeOn start it fetches settings and keeps a line open to a control server
- Sold onAccess is sold to partners, who push their own modules
- Cashed inResidential proxy, hidden ad views, more backdoors
Your home internet address is the product. Strangers rent it, and their traffic looks as if it came from your living room.
Sources: Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026. Simplified for readers; no indicators or technical details reproduced.
Powered by Thorsten Meyer AI
Why Factory Firmware Changes the Risk
The case differs from malware campaigns that rely on a user clicking a link or installing a malicious app. If a backdoor is placed in firmware before a device reaches its owner, ordinary caution around downloads may not prevent compromise. In Google’s account, the manufacturer’s role made the infection part of the device’s underlying software, rather than an app a user could simply remove.
That can affect people who use a box only for streaming: their home connection may be used to route outside traffic or generate fraudulent ad activity without their knowledge. For organisations, the report highlights how connected devices outside conventional computers can provide a route into networks. Google’s account also shows the limits of a server takedown: disrupting remote control does not, by itself, erase code stored on a device.
Products Worth Considering
Ledger Nano Gen5 Crypto Wallet, Black
Ledger Flex + Folio Crypto Hardware Wallet
Logitech MX Keys S Combo Wireless Keyboard and Mouse, Graphite
As an affiliate, we earn on qualifying purchases.
How the XCPE Backdoor Persisted
Google’s report, titled “Shutting the Door on the XCPE Botnet,” describes a system app identified in some builds as x.cpe and in others as com.oemservice. The app had system-level privileges and contacted a control server when the box started. Google says it could retrieve settings and maintain a connection through which operators issued commands or installed other software.
The report says the backdoor could restore itself from a protected partition after a reboot if removed. It also describes the malicious code disabling Google Play Protect checks before installing other apps. Google traces this design to at least late 2024 and says it used separate components for communicating with the server, loading software and running revenue-generating modules. In August 2026, Google observed new droppers disguised as Android system apps replacing the loader.
Videostrong is an Android original equipment and design manufacturer, meaning it makes devices for its own brand and for other companies’ brands. Google said it had high confidence in its attribution of the backdoor and botnet to Videostrong. The source material says Videostrong did not respond to requests for comment from The Record and heise. Google’s report describes legal action, but the source material says it did not identify a public court filing or case record.
“The backdoor and the botnet were “intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group, in its Nov. 2 report
What the Disruption Did Not Remove
The takedown disrupted the botnet’s control infrastructure, but Google says the firmware backdoor remains on affected boxes and can reinstall after a reboot. The available source material does not say whether the devices can be cleaned remotely, how many remain online, or what share of the reported total is still vulnerable. Uninstalling the visible app should not be assumed to remove the underlying persistence mechanism.
Some details of the legal action are also not public in the source material: it provides no court, case number or filing. Videostrong’s response to the allegations was not available in the account provided. Google’s wider estimate of at least 10 million additional devices is prospective and refers to devices affected by related malware channels, not a verified tally of XCPE boxes.
Firmware Checks and Device Response
Google says it has changed its review process to strengthen checks on firmware integrity in certified Android TV devices and has barred Videostrong from the certified Android program. The report does not specify when those checks will take effect across products or whether manufacturers will issue updates for affected models. Device owners and organisations should check a box’s Play Protect certification, be cautious with no-name or “unlocked” products, and treat a box suspected of infection as untrusted. Google’s account says removing an app is not enough; unplugging or replacing a suspect box and keeping TV devices on a separate guest network are options described in the source material.
For businesses, the incident may prompt a review of connected devices on home and office networks and of security practices that rely on IP addresses as a sign of trust. Further information would be needed to establish how many boxes can be remediated, whether owners will receive a software fix, and what legal steps follow. Until those points are clarified, the disruption should be understood as a cutoff of botnet control, not proof that affected devices have been cleaned.
Key Questions
What is the XCPE botnet?
It is a network of compromised Android TV set-top boxes that Google says were controlled through a firmware backdoor. Google reported more than 1.3 million boxes involved.
Who does Google say was behind it?
Google’s Threat Intelligence Group attributed the backdoor and botnet to Videostrong Technology, saying it had high confidence in the assessment. That is Google’s claim; the source material does not report a public court finding.
Did the late-October takedown remove malware from the boxes?
No. Google said the action disrupted the control infrastructure, while the backdoor remains in firmware and can reinstall after a reboot. The reported action should not be treated as a device-cleaning operation.
What did the infected boxes do?
Google said they were used mainly as residential proxies and for ad fraud. Its report also describes capabilities including screenshots, keystroke injection, data collection and remote command access.
What should owners of a potentially affected box do?
Check its Play Protect certification and treat a suspicious device as untrusted. The source material recommends unplugging or replacing a suspect box and placing TV devices on a separate guest network; uninstalling an app may not remove the firmware backdoor.
Source: ThorstenMeyerAI.com
