🔍 Read the full analysis: How Factory Malware Became A TV Box Botnet Problem on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Google and partners disrupted the control infrastructure for XCPE, a botnet that Google says involved more than 1.3 million set-top boxes. Google attributes the factory-installed backdoor to device maker Videostrong, but the backdoor remains in infected firmware and can return after a reboot.
Google and its partners disrupted the control infrastructure for XCPE, a botnet involving more than 1.3 million Android set-top boxes, the company said on November 2. Google alleges with high confidence that device maker Videostrong Technology built and operated a backdoor in the boxes’ firmware for profit, turning devices that looked like ordinary streaming hardware into residential proxies and ad-fraud tools.
Google’s Threat Intelligence Group said it worked with the Japan National Police Agency and security companies to disable domains and servers used to control XCPE and distribute malware. The disruption took place in late October. Google also said legal action targeted control servers for more than a dozen malware families that had been added to affected devices.
The scale figures come from different sources and periods. Google described the botnet as involving more than 1.3 million set-top boxes. Partner TrendAI counted 1,472,554 infected devices between June 3 and October 1, 2026, and characterized its count as a lower bound. Google separately estimated that disabling servers used by add-on malware could cut off access to at least 10 million more compromised devices across other distribution channels. That wider figure is an estimate, not a device count, and those devices are not all necessarily Android products.
Google says the malicious system app was called x.cpe in some versions and com.oemservice in others. It had system-level privileges and could restore itself from a protected partition after a reboot if removed. Google reported that operators used infected boxes as residential proxies and for ad fraud, and could also capture screenshots, inject keystrokes, collect account and device information, scan local networks and open remote shells.
Infographic 01 · XCPE in numbers
A botnet that shipped from the factory
Google says the device maker Videostrong built the backdoor into its own firmware and sold access. That is Google’s assessment; Videostrong did not respond to the press.
set-top boxes in the XCPE botnet, the joint figure of Google and its partners. Taken down in late October 2026.
- 1,472,554 infected devices in TrendAI’s own telemetry, 3 Jun to 1 Oct 2026, a lower bound.
- Partner counts differ by snapshot and view, so the joint figure is “more than 1.3 million”.
- 10M+ more devices lost their malware’s control servers: Google’s estimate, not a count.
How one box earns money for criminals
- Built inA system app sits in the firmware and reinstalls itself after a reboot
- Phones homeOn start it fetches settings and keeps a line open to a control server
- Sold onAccess is sold to partners, who push their own modules
- Cashed inResidential proxy, hidden ad views, more backdoors
Your home internet address is the product. Strangers rent it, and their traffic looks as if it came from your living room.
Sources: Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026. Simplified for readers; no indicators or technical details reproduced.
Powered by Thorsten Meyer AI
Why Factory Firmware Changes the Risk
The case differs from a typical infection in which a user clicks a malicious link or installs a deceptive app. Google says the backdoor was placed in device firmware before the boxes reached buyers. If that account is accurate, users could receive a compromised product without taking an obvious risky action, and ordinary app removal would not resolve the underlying problem.
Infected devices also made their owners’ internet connections useful to other parties. Residential proxy traffic can appear to come from a household or office rather than the operator’s own infrastructure. That can expose device owners to unwanted traffic and complicate efforts by websites and security teams to identify where activity originated. Google’s report also describes capabilities that could reach beyond the box itself, including local-network scanning.
The episode raises questions for device certification and supply-chain checks. Google said some affected boxes were Google-certified and that Videostrong used obfuscation to load malicious code after initial boot, bypassing checks. Google said it has banned the manufacturer from making certified Android devices and changed its firmware review process.
Popular right now
Sony BRAVIA XR8B 65-Inch 4K OLED Google TV (K-65XR8B)
TCL 65-Inch T7 Series 4K QLED Smart Google TV, 144Hz (65T7)
TCL 65-Inch QM6K QLED Mini-LED 4K HDR Smart Google TV, 144Hz
As an affiliate, we earn on qualifying purchases.
How the Backdoor Reached Buyers
Google’s November 2 report, titled Shutting the Door on the XCPE Botnet, describes Videostrong as an Android original equipment and original design manufacturer: a company that builds devices for its own brand or for other brands. Google says the company developed, deployed and operated the backdoor for financial gain, then sold access to criminal partners. Videostrong’s response was not included in the supplied reporting; The Record and heise said it did not respond to their requests for comment.
According to Google, the backdoor contacted a control server when a box started, retrieved settings and maintained a connection that allowed remote commands and silent installation of additional apps. Google says Play Protect checks were disabled before those installations. Since at least late 2024, the system used a stub, a separate loader and additional money-making modules. In August 2026, Google observed new droppers disguised as Android system apps replacing the loader.
The operation involved Google, the Japan National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI. Google said its actions included legal measures against the botnet’s domains and servers, a ban covering Videostrong and future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors, and tighter firmware-integrity checks for certified Android TV products.
“The backdoor and the botnet were “intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group
What the Takedown Did Not Remove
Disabling control servers disrupts operators’ ability to manage the botnet, but it does not remove the backdoor from infected firmware. Google’s account says the system app can restore itself after a reboot, so uninstalling an app is not a reliable fix. The supplied material does not establish how many devices remain infected, how many owners have replaced or isolated their boxes, or whether every control channel was disabled.
Google’s attribution to Videostrong is a company assessment, which it says is held with high confidence. The supplied reporting says Google did not publish the court filing and provides no public case number or court record. Videostrong’s response is not available in the source material. The exact number and identity of affected models and brands are also not provided here.
The reported capabilities include access to screenshots, keystrokes and device information, but the material does not say how often operators used each capability or identify specific victims. Nor does it verify the estimated total of additional compromised devices across other malware distribution channels.
Steps for Owners and Device Makers
Google said it has changed its review process for certified Android TV firmware and barred Videostrong and related future entities from supplying certified products. The supplied material does not give a timetable or technical details for the new checks, so their coverage and results are not yet known.
For owners, the guidance in the source is to check whether a box is Play Protect certified, be cautious with no-name or “unlocked” devices, and treat a box suspected of infection as untrusted. Unplugging or replacing it is safer than relying on deleting an app; keeping TV boxes on a separate guest network can limit their access to other devices. Businesses should also treat home and office internet-connected devices as part of their security exposure rather than relying only on IP reputation to judge traffic.
Further reporting would need to establish which models were affected, whether manufacturers or retailers will offer replacements or other remedies, and how many devices can be cleaned or must be retired. Until those details are available, the botnet’s control disruption should not be mistaken for proof that every compromised box has been repaired.
Key Questions
What was the XCPE botnet?
XCPE was a botnet involving Android set-top boxes with a backdoor in their firmware, according to Google. Operators used the devices mainly as residential proxies and for ad fraud, with other remote-control capabilities also reported.
How many devices were affected?
Google said XCPE involved more than 1.3 million set-top boxes. TrendAI counted 1,472,554 infected devices from June 3 to October 1, 2026, and called that a lower bound. Google’s separate estimate of at least 10 million additional compromised devices concerns malware spread through other channels, not a confirmed count of XCPE boxes.
Did the takedown remove the malware from infected boxes?
No. The actions disrupted the botnet’s control infrastructure, but Google says the backdoor remains in firmware and can reinstall itself after a reboot. Removing an app alone may not remove it.
What should owners of an affected or suspicious TV box do?
Check the device’s Play Protect certification and be wary of no-name or “unlocked” boxes. If a device is suspected of infection, the supplied guidance is to unplug or replace it and keep TV boxes on a separate guest network rather than treating app deletion as a fix.
Has Videostrong responded to the allegation?
The supplied reporting says Videostrong did not respond to requests for comment from The Record and heise. The material also says Google did not publish the court filing, and it gives no public case number or court record.
Source: ThorstenMeyerAI.com
