🔍 Read the full analysis: Google Takes Down A Botnet Linked To Malware On Millions Of TV Boxes on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Google and its partners disrupted the control infrastructure for XCPE, a botnet linked to more than 1.3 million set-top boxes. Google says the backdoor was built into firmware by device maker Videostrong for financial gain; the control disruption does not remove the backdoor from affected devices.
Google’s Threat Intelligence Group said it worked with industry partners and Japan’s National Police Agency to disrupt the control infrastructure of XCPE, a botnet linked to more than 1.3 million set-top boxes. Google alleges that Shenzhen-based device maker Videostrong Technology Co. built and operated a firmware backdoor for profit, turning affected boxes into tools for residential proxy traffic and ad fraud.
Google published its report, “Shutting the Door on the XCPE Botnet,” on Nov. 2, 2026, saying the disruption took place in late October. The company said legal action targeted domains and servers Videostrong used to control the botnet and distribute malware. It also said it pursued control servers associated with more than a dozen malware families that had been installed on boxes as add-ons.
Google said it worked with Japan’s National Police Agency and security firms Lumen, HUMAN Security, Plume, Synthient and TrendAI. TrendAI counted 1,472,554 infected devices between June 3 and Oct. 1, 2026, and described that figure as a lower bound. Google’s broader description was “more than 1.3 million”; the figures refer to different reporting and should not be treated as a separate estimate of the total number of devices worldwide.
According to Google, the boxes commonly routed third-party traffic through owners’ home internet connections as residential proxies and carried out ad fraud. The company also observed operators taking screenshots, injecting keystrokes, collecting account and device information, and opening remote shells. These are capabilities Google reported finding; the source material does not establish that every infected box performed every action.
Infographic 01 · XCPE in numbers
A botnet that shipped from the factory
Google says the device maker Videostrong built the backdoor into its own firmware and sold access. That is Google’s assessment; Videostrong did not respond to the press.
set-top boxes in the XCPE botnet, the joint figure of Google and its partners. Taken down in late October 2026.
- 1,472,554 infected devices in TrendAI’s own telemetry, 3 Jun to 1 Oct 2026, a lower bound.
- Partner counts differ by snapshot and view, so the joint figure is “more than 1.3 million”.
- 10M+ more devices lost their malware’s control servers: Google’s estimate, not a count.
How one box earns money for criminals
- Built inA system app sits in the firmware and reinstalls itself after a reboot
- Phones homeOn start it fetches settings and keeps a line open to a control server
- Sold onAccess is sold to partners, who push their own modules
- Cashed inResidential proxy, hidden ad views, more backdoors
Your home internet address is the product. Strangers rent it, and their traffic looks as if it came from your living room.
Sources: Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026. Simplified for readers; no indicators or technical details reproduced.
Powered by Thorsten Meyer AI
The Risk Behind Connected TV Boxes
The case shifts attention from the usual consumer risk of downloading a malicious app to the device supply chain. Google alleges the backdoor was present in firmware before the boxes reached buyers. If that account is correct, owners could have been exposed without clicking a link or installing a suspicious application, while their internet connections could be used to make other people’s traffic appear to come from their homes.
Google also said some affected devices had been Google-certified. It alleges Videostrong used obfuscation and delayed loading the malicious code until after first boot to get around checks. Google said it has barred Videostrong from building certified Android devices or supplying software to certified vendors and has tightened firmware integrity reviews. The report does not establish that certification is a guarantee against all malicious firmware; rather, this incident highlights limits in the review process described by Google.
The takedown may disrupt criminal activity, but it is not the same as cleaning every device. Google says the firmware backdoor remains and can reinstall itself after a reboot. That leaves owners and organizations with a practical security concern even after the command servers are taken offline.
Products Worth Considering
Amazon Kindle Scribe (64GB) with Premium Pen, Metallic Jade
Amazon Kindle Paperwhite (2024), 16 GB, 7-inch Display, Black
Amazon Kindle Paperwhite Signature Edition, 32GB (2024), Metallic Black
As an affiliate, we earn on qualifying purchases.
How XCPE Reached the Boxes
Google described the backdoor as a small system app, identified in some builds as x.cpe or com.oemservice, embedded in firmware with system-level privileges. According to the report, it could restore itself from a protected partition after a reboot if removed. Once running, it contacted a control server and could receive instructions, including to install other apps silently.
Google said the malware disabled Google Play Protect checks before installing additional software. The system had multiple layers: a component that communicated with the server, a loader, and separate modules used to generate revenue. Google traced this structure to at least late 2024 and said new droppers disguised as Android system apps appeared in August 2026.
Google also estimated that shutting down control servers for the add-on malware could cut access to at least 10 million additional compromised devices. That is Google’s estimate, not a device count from the XCPE tally, and the source material says those devices may include non-Android systems. It should not be combined with the more than 1.3 million set-top boxes as though both figures describe the same population.
“The backdoor and the botnet “were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group
What the Takedown Does Not Resolve
Google’s report identifies Videostrong as responsible with what it calls “high confidence.” The source material says the company did not respond to requests for comment from The Record and heise. It does not provide a public court filing, case number or court, so the legal actions and allegations cannot be independently assessed from those records here.
The total number of affected boxes, the brands and models involved, and the number still online are not specified in the supplied reporting. The 1,472,554 figure covers TrendAI’s count from June 3 to Oct. 1, 2026; it is not a full account of all devices ever infected. It is also unclear how many owners’ personal information was accessed or what harm resulted from the reported capabilities.
Most important for owners, the disruption of control servers does not remove the firmware backdoor. The source material says it persists through reboot, but does not identify a reliable software fix for every affected model or say whether all command channels have been disabled.
Device Checks and Google’s Review Changes
Google said it has barred Videostrong and any future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors, and that it is tightening firmware integrity checks for certified Android TV devices. The company has not provided, in the supplied material, a detailed timetable or public technical specification for those changes.
Owners can check whether a device is Play Protect certified, but certification alone cannot establish that a box is clean. The source material advises treating a suspicious or unfamiliar box as untrusted: unplug it or replace it, and keep TV devices on a separate guest network where possible. Removing an app is not a dependable remedy for the firmware backdoor Google describes.
Organizations should account for connected TV boxes and other internet-connected devices in their security planning. The report’s proxy findings also mean that a connection appearing to come from a household or office IP address may have been routed through a compromised device; IP reputation alone may not identify who generated the traffic. Further information on affected models, device remediation and the legal proceedings remains outstanding.
Key Questions
What did Google take down?
Google said it and its partners disrupted the XCPE botnet’s control infrastructure in late October 2026, including domains and servers used to control infected boxes and distribute malware.
How many TV boxes were involved?
Google said XCPE involved more than 1.3 million set-top boxes. TrendAI separately counted 1,472,554 infected devices between June 3 and Oct. 1, 2026, calling its count a lower bound.
Does the takedown remove the malware from an infected box?
No. Google says the backdoor remains in the firmware and can reinstall itself after a reboot. Taking down the control infrastructure disrupts remote control but does not, by itself, clean the device.
What should owners of a suspicious TV box do?
Check the device’s Play Protect certification, but do not treat certification as proof that it is safe. Google-related guidance in the source material recommends unplugging or replacing a suspicious box and placing TV devices on a separate guest network.
Has Videostrong responded to the allegation?
The source material says Videostrong did not respond to requests for comment from The Record and heise. Google’s account is an attributed allegation; the supplied reporting does not include a company response or public court filing.
Source: ThorstenMeyerAI.com
