🔍 Read the full analysis: Factory-Linked Malware At The Center Of Google’s TV Box Botnet Takedown on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Google and industry partners disrupted the control infrastructure for the XCPE botnet, which Google says involved more than 1.3 million set-top boxes. Google attributes the firmware backdoor to device maker Videostrong, but the company has not publicly responded; the malware may remain on affected boxes after the takedown.
Google said on November 2 that it and industry partners had disrupted the control infrastructure for XCPE, a botnet involving more than 1.3 million set-top boxes. Google’s Threat Intelligence Group (GTIG) says the backdoor was built into device firmware by manufacturer Videostrong Technology Co., allowing infected boxes to be used for residential proxy traffic and ad fraud without owners’ knowledge.
Google said the operation involved Japan’s National Police Agency and security companies Lumen, HUMAN Security, Plume, Synthient and TrendAI. The partners acted against domains and servers used to control XCPE and distribute malware. Google also said it took legal action against control servers for more than a dozen malware families that had been installed on the boxes as add-ons.
TrendAI counted 1,472,554 infected devices between June 3 and October 1, 2026, and described that total as a lower bound. Google separately characterized the botnet as involving more than 1.3 million set-top boxes. The two figures refer to reported counts of infected devices; the source material does not provide a method for reconciling them.
According to GTIG, the firmware backdoor could contact a control server, receive instructions and allow operators to install apps, run commands, capture screens, scan local networks and access device or account data. Google says the boxes were used mainly as residential proxies, routing third-party internet traffic through owners’ connections, and for ad fraud. The company also says some operators could inject keystrokes and open remote shells.
Infographic 01 · XCPE in numbers
A botnet that shipped from the factory
Google says the device maker Videostrong built the backdoor into its own firmware and sold access. That is Google’s assessment; Videostrong did not respond to the press.
set-top boxes in the XCPE botnet, the joint figure of Google and its partners. Taken down in late October 2026.
- 1,472,554 infected devices in TrendAI’s own telemetry, 3 Jun to 1 Oct 2026, a lower bound.
- Partner counts differ by snapshot and view, so the joint figure is “more than 1.3 million”.
- 10M+ more devices lost their malware’s control servers: Google’s estimate, not a count.
How one box earns money for criminals
- Built inA system app sits in the firmware and reinstalls itself after a reboot
- Phones homeOn start it fetches settings and keeps a line open to a control server
- Sold onAccess is sold to partners, who push their own modules
- Cashed inResidential proxy, hidden ad views, more backdoors
Your home internet address is the product. Strangers rent it, and their traffic looks as if it came from your living room.
Sources: Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026. Simplified for readers; no indicators or technical details reproduced.
Powered by Thorsten Meyer AI
The Risk of a Factory-Built Backdoor
The case shifts the security concern from an owner clicking a malicious link to the device supply chain. If Google’s account is accurate, the backdoor was present in firmware before some boxes reached customers. That makes ordinary precautions such as avoiding suspicious links or deleting an unfamiliar app insufficient for those devices.
Infected boxes can make household or office internet connections appear to be the source of traffic generated by someone else. That can expose owners to service disruption, privacy risks and reputational or investigative complications, even if they did not knowingly participate. Google’s account of screen capture, keystroke injection and remote shells also points to capabilities beyond proxy use, though it has not publicly detailed how often those functions were used.
The alleged involvement of a device manufacturer also matters to buyers of low-cost streaming hardware and to businesses that allow unmanaged connected devices on their networks. Google says some affected boxes had Android certification, raising questions about how firmware checks were bypassed and what certification can tell a buyer about a device’s security.
Popular right now
TCL 65 Inch QM8L Series SQD-Mini LED QLED 4K Smart Google TV
Sony BRAVIA XR8B 65-Inch 4K OLED Google TV (K-65XR8B)
TCL 65-Inch QM6K QLED Mini-LED 4K HDR Smart Google TV, 144Hz
As an affiliate, we earn on qualifying purchases.
How XCPE Reached TV Boxes
Google’s November 2 report, titled “Shutting the Door on the XCPE Botnet,” describes a small system app, identified in some builds as x.cpe or com.oemservice, embedded in firmware with system-level privileges. GTIG says the app could restore itself from a protected partition after a reboot if a user removed it. That means deleting an app would not necessarily remove the underlying backdoor.
Google says the boxes contacted control servers after startup and could receive malware modules supplied by affiliates. The structure separated the component communicating with the server from a loader and additional modules. GTIG says the design had at least three layers from late 2024 and that new droppers disguised as Android system apps appeared in August 2026.
Google alleges Videostrong used obfuscation to load malicious code after a device’s first boot, allowing it to evade checks. The company says it has barred Videostrong and any future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors, and has tightened firmware-integrity reviews for certified Android TV devices.
“The backdoor and the botnet were “intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group
What the Takedown Cannot Remove
The disruption of control servers does not necessarily remove malware already stored on a device. The source report says the backdoor can reinstall itself after a reboot, so an app uninstall may not be enough; the material does not say that every infected box remains controllable or that the malware has been removed from affected firmware.
Videostrong did not respond to requests for comment reported by The Record and heise, according to the source material. Google’s accusation has not been accompanied here by a public court filing or case number. The precise number of affected devices, the full list of models and brands, and how many certified devices were infected are also not established in the available reporting.
Google’s estimate of at least 10 million additional compromised devices concerns other malware families and channels, and is an estimate rather than a measured device count. The source material also does not establish how many owners experienced specific harms, such as account access or local network scanning.
Checks for Owners and Network Teams
Owners of Android TV boxes can check whether a device is Play Protect certified, but certification alone should not be treated as proof that a device is free of compromise. Google’s response includes tighter firmware-integrity checks, though the company has not provided a detailed public timeline or technical account of those changes in the source material.
For a box that seems suspicious, the source recommends treating it as untrusted: disconnect it or replace it rather than relying on an app uninstall. Keeping streaming devices on a separate guest network can limit their access to other devices on a home or office network. Businesses should include connected devices in their security planning and avoid relying on an IP address’s reputation alone, since a residential address may be carrying traffic generated by a proxy user.
Further clarity depends on additional disclosures from Google, law enforcement or affected manufacturers, including device and brand lists, the legal actions taken and whether firmware remediation will be available. Until those details emerge, owners cannot readily determine from the information provided whether a specific model was affected.
Key Questions
What was the XCPE botnet?
XCPE was a network of compromised set-top boxes, according to Google. The company says operators used the devices mainly as residential proxies and for ad fraud, with additional capabilities including screen capture and remote commands.
How many devices were involved?
Google said the botnet involved more than 1.3 million set-top boxes. TrendAI counted 1,472,554 infected devices from June 3 to October 1, 2026, calling its figure a lower bound. The reports do not explain the difference between their figures.
Did Google remove the malware from affected boxes?
The reported action targeted control servers and domains, not necessarily the malware stored on each device. The source material says the backdoor may reinstall after a reboot, so deleting an app may not remove it.
What should TV box owners do?
Check Play Protect certification, be cautious about no-name or “unlocked” devices, and keep streaming hardware on a separate guest network. If a box appears suspicious, the source recommends disconnecting or replacing it rather than relying on an app uninstall.
Has Videostrong confirmed Google’s claims?
No response from Videostrong is included in the source material. It says the company did not respond to requests for comment reported by The Record and heise, and it provides no public court filing or case number.
Source: ThorstenMeyerAI.com
