TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Google and industry partners disrupted the control infrastructure for XCPE, a botnet linked to more than 1.3 million set-top boxes. Google attributes the firmware backdoor to Videostrong Technology, but the infected software remains on affected devices and can return after a reboot.
Google’s Threat Intelligence Group said it and industry partners disrupted the XCPE botnet in late October, cutting off control servers used to manage more than 1.3 million set-top boxes. Google says the backdoor was built into device firmware by manufacturer Videostrong Technology, turning affected boxes into residential proxies and tools for ad fraud; the disruption has not removed the backdoor from devices already sold.
In a report published November 2, Google said the operation involved the Japan National Police Agency and security firms Lumen, HUMAN Security, Plume, Synthient and TrendAI. Google described legal action to disrupt domains and servers used to control XCPE and to interfere with servers associated with more than a dozen malware families installed as add-ons. It also said Videostrong and future subsidiaries or affiliates had been barred from building certified Android devices or supplying software to certified vendors, and that it had tightened firmware integrity checks.
The scale figures describe different measurements. Google said XCPE involved more than 1.3 million set-top boxes. TrendAI counted 1,472,554 infected devices from June 3 to October 1, 2026, and described its count as a lower bound. Google also estimated that taking down add-on malware control servers would cut off access to at least 10 million additional compromised devices. That figure is an estimate, not a verified count of devices in XCPE, and reports cited in the source say the additional devices do not all run Android.
Google said infected boxes were used mainly to route third-party traffic through owners’ home connections and to commit ad fraud. Its report also describes operators taking screenshots, injecting keystrokes, collecting account and device information, opening remote shells and installing apps silently. The backdoor is a system app identified as x.cpe or, in some builds, com.oemservice. Google says it has system-level privileges, can disable Play Protect checks and reinstalls itself from a protected partition after a reboot if removed.
Google Disrupts XCPETV Box Botnet
Google and industry partners disrupted the botnet’s control servers. The firmware backdoor remains on affected boxes and can return after a reboot.
What the disruption changed
The operation cut off control infrastructure; it did not clean devices already sold.
- XCPE control domains and servers
- Servers linked to more than a dozen malware families
- Operators’ ability to direct infected boxes
- Backdoor remains in affected firmware
- It can reinstall after a reboot
- Owners lack a universal cleanup tool
How infected boxes were used
Residential proxies
Boxes routed third-party traffic through owners’ home connections.
Ad fraud
Google says operators used the devices to commit ad fraud.
Remote control
Capabilities described include screenshots, keystrokes, account data, remote shells and silent app installs.
What owners and businesses can do
Google says the backdoor is built into firmware, so removing an app may not make a box safe.
Check whether the TV box is Play Protect certified; the source gives no universal scan method.
The guidance recommends unplugging or replacing a suspicious device and placing TV boxes on a separate guest network.
Businesses should include TV boxes and similar IoT devices in network risk reviews.
Risks Persist After Server Disruption
Cutting off command servers can limit operators’ ability to direct infected boxes, but it does not clean the devices. Google says the firmware backdoor can reinstall after a reboot, so an app removal may give owners a false sense that the box is safe. The report does not say that every infected device remains reachable or that every listed capability was used against every owner; it describes what the operators could do.
The case also raises questions for buyers and platform certification. Google says some affected boxes were certified Android devices and that Videostrong used obfuscation to load malicious code after the initial boot, after checks had taken place. For households and businesses, that means a device that looks like an ordinary streaming box may also expose a network connection and local devices to outside traffic. Google recommends treating suspicious boxes as untrusted; businesses may need to account for home and office IoT devices when evaluating network risk.
Products Worth Considering
Apple MacBook Air 13-inch with M5 chip, 16GB memory, 512GB SSD, and 12MP Center Stage camera
Amazon Kindle Paperwhite (2024), 16 GB, 7-inch Display, Black
Amazon Kindle Paperwhite Signature Edition, 32GB (2024), Metallic Black
As an affiliate, we earn on qualifying purchases.
How XCPE Reached TV Boxes
Google says the backdoor was installed in firmware before affected boxes left the factory, rather than being introduced through a user clicking a malicious link or installing a fake app. Videostrong is described in the report as an Android original equipment and original design manufacturer, meaning it builds devices for its own brand and for other brands. Google said it had high confidence that the company developed and operated the backdoor for financial gain and sold access to criminal partners. That is Google’s attribution; Videostrong did not respond to requests for comment from The Record and heise, according to the source material.
Google said the malware design had at least three layers since late 2024: a component that contacts the server, a separate loader, and revenue-generating modules supplied by partners. In August 2026, Google observed new droppers disguised as Android system apps replacing the loader. The company interpreted that change as an effort to remain hidden. The source material says Google worked with law enforcement and industry partners, but does not provide a public court filing, court name or case number for the legal actions.
“The backdoor and the botnet “were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group
Questions About Infected Devices
Google has not published, in the source material, a list of affected box models or a way to determine whether a specific device contains the backdoor beyond checking its certification status. The source does not establish how many infected boxes remain in use, how many were reached by the server disruption, or whether the operators retained any access through other infrastructure. A server takedown also does not show that the firmware flaw has been removed from devices in owners’ homes.
Google’s attribution to Videostrong is a company finding, not an independently adjudicated conclusion in the material provided. Videostrong did not respond to requests for comment reported by The Record and heise. The details of the legal action, including any public case record, court or case number, were also not available in the source material.
Device Checks and Firmware Response
Google says it has changed its review process for certified Android TV devices and barred Videostrong and related future entities from building certified devices or supplying software to certified vendors. The report does not specify when owners might receive firmware updates, whether any update can fully remove the backdoor, or whether affected manufacturers will provide remediation. Owners should check whether a box is Play Protect certified and treat an unknown or suspicious device as untrusted; the source recommends unplugging or replacing it and placing TV boxes on a separate guest network. It does not identify a Google tool that can scan and clean every affected box.
Businesses should review connected TV boxes and similar IoT devices on office networks and avoid relying on IP reputation alone, since residential proxy traffic can come from apparently ordinary consumer connections. Further developments to watch include any public details about the legal action, updated device guidance from Google or manufacturers, and evidence that firmware changes have removed the persistent backdoor from affected boxes.
Key Questions
What did Google and its partners disrupt?
They disrupted control infrastructure for XCPE, which Google linked to more than 1.3 million set-top boxes. The action targeted domains and servers used to manage the botnet and related malware.
Does the disruption remove the malware from my TV box?
No. Google says the firmware backdoor remains on affected devices and can reinstall itself after a reboot if removed as an app. The source does not describe a universal cleanup tool or firmware update for owners.
Who does Google say was behind XCPE?
Google says with high confidence that Videostrong Technology developed and operated the backdoor for financial gain. This is Google’s attribution. Videostrong did not respond to comment requests reported by The Record and heise.
How can owners check a set-top box?
The source recommends checking the box’s Play Protect certification and treating an unknown or suspicious box as untrusted. It advises unplugging or replacing a suspicious device and keeping TV boxes on a separate guest network.
What were the infected boxes used for?
Google said they were used mainly as residential proxies and for ad fraud. Its report also describes capabilities including screenshots, keystroke injection, data collection, remote shells and silent app installation; it does not establish that every capability was used on every device.
Source: Thorsten Meyer AI
