🔍 Read the full analysis: What The 1.3-Million-Device TV Box Botnet Reveals About Factory Malware on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Google and industry partners said they disrupted the XCPE botnet, which involved more than 1.3 million set-top boxes with malware allegedly built into their firmware by manufacturer Videostrong. The boxes were used for residential proxy traffic, ad fraud and other remote operations. The takedown cut off control servers, but Google says the backdoor can persist after reboot, and the full number of affected devices and cleanup status remain unclear.
Google’s Threat Intelligence Group said it and industry partners disrupted the XCPE botnet in late October, cutting off control servers used to manage more than 1.3 million set-top boxes. Google alleges that Shenzhen-based manufacturer Videostrong Technology built and operated a backdoor in the devices’ firmware for financial gain, meaning the malware could be present before buyers first turned on their boxes.
In a report published November 2, Google said it worked with Japan’s National Police Agency and security companies Lumen, HUMAN Security, Plume, Synthient and TrendAI to take action against XCPE. Google described legal steps to disrupt domains and servers used to control the botnet and distribute malware, as well as control servers associated with more than a dozen malware families delivered as add-ons. Google also said it barred Videostrong and its future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors, and tightened firmware-integrity checks for certified Android TV devices.
The device count depends on the source and method. Google said the botnet involved more than 1.3 million set-top boxes. TrendAI counted 1,472,554 infected devices from June 3 to October 1, 2026, describing that figure as a lower bound. The figures should not be read as a complete count of every device affected by related malware. Google separately estimated that disrupting add-on malware control servers could cut access to at least 10 million additional compromised devices; that is an estimate, and the source material says those devices were not all Android devices.
Google said the boxes were used mainly as residential proxies, routing other people’s internet traffic through owners’ home connections, and for ad fraud. Its report also describes capabilities including taking screenshots, recording keystrokes, collecting account and device information, opening remote shells and scanning local networks. These are reported capabilities; the source material does not establish that every infected box performed every activity.
Infographic 01 · XCPE in numbers
A botnet that shipped from the factory
Google says the device maker Videostrong built the backdoor into its own firmware and sold access. That is Google’s assessment; Videostrong did not respond to the press.
set-top boxes in the XCPE botnet, the joint figure of Google and its partners. Taken down in late October 2026.
- 1,472,554 infected devices in TrendAI’s own telemetry, 3 Jun to 1 Oct 2026, a lower bound.
- Partner counts differ by snapshot and view, so the joint figure is “more than 1.3 million”.
- 10M+ more devices lost their malware’s control servers: Google’s estimate, not a count.
How one box earns money for criminals
- Built inA system app sits in the firmware and reinstalls itself after a reboot
- Phones homeOn start it fetches settings and keeps a line open to a control server
- Sold onAccess is sold to partners, who push their own modules
- Cashed inResidential proxy, hidden ad views, more backdoors
Your home internet address is the product. Strangers rent it, and their traffic looks as if it came from your living room.
Sources: Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026. Simplified for readers; no indicators or technical details reproduced.
Powered by Thorsten Meyer AI
Why Firmware-Level Access Matters
The case puts the point of infection earlier in the supply chain than the usual fake-app or malicious-link scenario. If malware is built into device firmware before sale, users may have little reason to suspect the box, and ordinary steps such as uninstalling an app may not remove the underlying access. Google says the backdoor can reinstall itself from a protected partition after a reboot, so the server takedown should not be confused with a complete device cleanup.
For households, a compromised streaming box can expose the home internet connection to traffic controlled by others. For organizations, the incident is a reminder that low-cost connected devices on home or office networks can create security risks even when they are not conventional computers. The source article also advises against relying only on an IP address’s reputation when assessing traffic, because residential proxy services can make malicious activity appear to come from ordinary consumer connections.
The allegations also raise questions about trust in certification. Google said some affected boxes were certified and that Videostrong used obfuscation to evade checks by loading malicious code after first boot. Certification is therefore relevant, but the report indicates it did not prevent every compromised device from reaching users.
Products Worth Considering
LG UltraGear 27G640A-B 27-Inch QHD IPS Gaming Monitor, 300Hz, 1ms, G-SYNC Compatible, FreeSync Premium, DisplayHDR 400
LG UltraGear 32GX850A-B 32-inch 4K UHD Glossy OLED Gaming Monitor
LG UltraGear 32GX870A-B 32-inch 4K OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How XCPE Reached TV Boxes
Google’s report, titled “Shutting the Door on the XCPE Botnet,” says the backdoor was a system app embedded in firmware. It identifies the component as x.cpe in some builds and com.oemservice in others. According to Google, the component had system-level privileges, contacted a control server when the box started and could retrieve instructions. If removed by a user, it could be restored from a protected partition at the next reboot.
Google said the operation had developed over time. Since at least late 2024, it had three layers: a component communicating with the server, a separate loader and modules that carried out monetized or other tasks. The report says that in August 2026, new droppers disguised as Android system apps began replacing the loader. Google interpreted that change as an effort to remain concealed.
Google characterized Videostrong as an Android original equipment and original design manufacturer, meaning it builds devices for its own brand and for other brands. The company’s accusation is that Videostrong developed, deployed and operated the backdoor and sold access to criminal partners. The supplied source material says Videostrong did not respond to comment requests from The Record and heise; the allegation should not be treated as an independently established finding.
““more than 1.3 million set-top boxes””
— Google Threat Intelligence Group
What the Takedown Did Not Resolve
The source material does not provide a complete list of affected models, brands, retailers or countries, or a final count of devices still reachable after the disruption. Google’s figure, TrendAI’s time-bounded lower-bound count and Google’s separate estimate of additional compromised devices describe different populations and should not be combined into a single total.
It is also unclear how many boxes remain infected, whether every control server has been disabled, and whether manufacturers or service providers will provide a lasting firmware fix. Google says the backdoor can survive a reboot, but the supplied report does not describe a universal removal method or confirm that the takedown erased malware from devices already sold. The source material says Google took legal action but does not include public court filings or case details. Videostrong’s response to the allegations is not included.
Device Checks and Further Response
Google says its next steps include stronger checks of firmware integrity on certified Android TV devices and continued enforcement against Videostrong’s eligibility to build certified products. The source material does not give a timetable for those checks or describe a specific firmware update for affected boxes. Owners should look up whether a device is Play Protect certified, be cautious with no-name or “unlocked” boxes, and treat a suspected device as untrusted. The source article recommends unplugging or replacing it and placing TV boxes on a separate guest network.
Businesses should review connected devices on their networks, including consumer-grade equipment used by employees, and avoid treating an apparently residential IP address as proof that traffic is benign. Further reporting will be needed to establish which products were affected, whether manufacturers issue fixes and how many devices remain compromised after the control infrastructure was disrupted.
Key Questions
What happened to the XCPE botnet?
Google and partners said they disrupted its control infrastructure in late October 2026. Google reported that the botnet involved more than 1.3 million set-top boxes.
How did the malware get onto the TV boxes?
Google says the backdoor was built into device firmware before the boxes reached users, rather than being installed through a typical user-downloaded app. It alleges that manufacturer Videostrong was responsible.
Does the takedown remove malware from an infected box?
Not necessarily. Google says the backdoor can restore itself from a protected partition after reboot. The supplied report describes disruption of control servers, not a universal process for cleaning devices already sold.
What did the infected boxes do?
Google said they were used mainly as residential proxies and for ad fraud. It also reported capabilities such as screenshots, keystroke capture, data collection and remote shell access; it did not say every box used every capability.
What should owners do if they suspect their box is affected?
Check the device’s Play Protect certification and treat a suspicious box as untrusted. The source article recommends unplugging or replacing it and keeping TV boxes on a separate guest network; it does not identify a confirmed universal software fix.
Source: ThorstenMeyerAI.com
