TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Google and partner organizations say they disrupted the XCPE botnet in late October after tracing it to a backdoor in Android set-top box firmware. Google attributes the operation to device maker Videostrong; the company has not responded to media requests cited in the source reports. The disruption cut access to control servers, but the backdoor may remain on affected devices.
Google says it and industry partners disrupted the XCPE botnet in late October, cutting off control servers used to manage more than 1.3 million Android set-top boxes. In a report published November 2, Google’s Threat Intelligence Group attributed the firmware backdoor to device maker Videostrong Technology Co., saying the boxes were used for residential proxy traffic, ad fraud and other remote activity.
Google said it worked with Japan’s National Police Agency and security companies Lumen, HUMAN Security, Plume, Synthient and TrendAI. The operation targeted domains and servers that Videostrong allegedly used to control the botnet and distribute malware. Google also said it pursued control servers for more than a dozen malware families that had been added to affected boxes.
TrendAI counted 1,472,554 infected devices between June 3 and October 1, 2026, and described that figure as a lower bound. Google’s report uses the broader description “more than 1.3 million set-top boxes.” Those figures refer to devices observed during the stated period; they do not establish how many remain online or how many owners knew their boxes were compromised.
According to Google, the boxes primarily routed third-party internet traffic through household connections and generated fraudulent ad activity. The company also reported that operators could capture live screenshots, inject keystrokes, collect account and device information, open remote shells and scan local networks. These are findings and characterizations from Google’s report; the source material does not include an independent technical assessment of each activity.
Was Your TV Box Part of the Botnet Linked to Factory Malware?
Google says it disrupted the XCPE botnet in late October, cutting control-server access for more than 1.3 million Android set-top boxes. The firmware backdoor may remain on affected devices.
What the boxes enabled
Google says operators used household connections and device access for remote activity.
Activity routed through homes
The boxes routed third-party internet traffic through ordinary subscriber connections.
Fraudulent ad activity
Google says infected devices generated activity that appeared to come from real viewers.
More than streaming
Reported capabilities included capturing screenshots, collecting data, running commands and scanning local networks.
How the backdoor persisted
Google describes a system-level app embedded in device firmware.
The app, called x.cpe or com.oemservice in some builds, had system-level privileges.
Google says it could restore itself from a protected partition after a restart.
It contacted a control server and could enable silent app installs or commands.
What the disruption changed
- Google and partners targeted domains and servers used to manage the botnet.
- Google says the action cut remote access to control infrastructure.
- The takedown does not remove the backdoor from firmware.
- The report does not identify every affected model, brand or retailer.
Steps for owners and organizations
Treat connected boxes as part of the network’s security picture.
- Check Play Protect certification in device settings; certification alone does not confirm whether a unit was affected.
- If a box seems suspect, disconnect or replace it and keep TV devices on a separate guest network.
- Do not treat uninstalling an app or rebooting as proof that the firmware backdoor is gone.
- Organizations can review which streaming devices connect to office networks.
Risks Behind the TV Screen
A compromised streaming box can make a home or office internet connection part of someone else’s infrastructure. Residential proxy traffic can obscure the origin of online activity by routing it through an ordinary subscriber connection. That can expose the connection’s address to activity its owner did not initiate, while ad fraud uses device resources to generate activity that appears to come from real viewers.
The case also raises questions about how consumers can judge low-cost connected devices. Google said some infected boxes were Google-certified. It alleges Videostrong delayed loading malicious code until after a device’s first boot, helping it evade review. Google said it has banned Videostrong from building certified Android devices and changed its firmware review process. The report does not identify every affected model, brand or retailer, leaving owners with limited ways to determine exposure from a product name alone.
For businesses, the reported ability to scan local networks and collect device data makes a TV box more than an isolated entertainment device. Google’s findings support treating connected boxes as part of a network’s security picture, including when employees bring devices into offices or connect them at home to work systems.
Products Worth Considering
LG UltraGear 32GX850A-B 32-inch 4K UHD Glossy OLED Gaming Monitor
Amazon Kindle Scribe (64GB) with Premium Pen, Metallic Jade
Samsung 34-Inch Odyssey G5 Ultra-Wide Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How the Firmware Backdoor Worked
Google describes the backdoor as a small system app called x.cpe, also found under the name com.oemservice in some builds. It was embedded in firmware and had system-level privileges. According to the report, if a user removed the app, it could restore itself from a protected partition after the box restarted. That means deleting an app through the usual interface would not remove the underlying backdoor.
After startup, the backdoor contacted a control server for instructions and maintained a connection to it. Google says it could fetch settings and enable operators to install apps silently or run commands. Before installing other software, it disabled checks by Google Play Protect, Google’s feature for identifying harmful apps. Google said the system had been structured in three layers since at least late 2024: a component that contacted the server, a separate loader, and additional modules used to carry out activity.
Google also reported that new droppers disguised as Android system apps began replacing the loader in August 2026. It interpreted that change as an effort to stay hidden. In addition to the box botnet, Google expects the takedown of related malware control servers to cut access to “at least 10 million additional compromised devices.” That is the company’s estimate, not a verified count of affected devices; the source material says those devices were compromised through other channels and not all run Android.
““The backdoor and the botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group
Questions About Affected Devices
The source material does not list all affected brands, model numbers, firmware versions or sales channels. It is also unclear how many infected devices were active when the control servers were disrupted, how many have since been replaced, or how many users received warnings. Google’s report describes some devices as certified, but that does not establish that every certified Android TV box was affected.
The server disruption limits remote control, according to Google’s account, but it does not remove the backdoor from firmware. The report says the component can reinstall after a reboot, so the current status of an individual box cannot be determined from the takedown alone. The source material does not describe a consumer removal tool or a firmware update that cleans every affected device.
Google says Videostrong operated the system for profit, but the material provided does not include a public court filing, case number or court record. The allegations should therefore be understood as Google’s account. Videostrong’s response was not available in the cited reporting.
Checking and Isolating TV Boxes
Google says it has banned Videostrong from making certified Android devices or supplying software to certified vendors, and has changed its review process for Android TV firmware. The company also says legal action targeted the botnet’s control infrastructure. The source material does not give a schedule for additional actions or identify a public list of affected products.
Owners can check whether a device is Play Protect certified in its settings, though certification alone may not settle whether a particular unit was affected. Google’s report and the supplied source material advise caution with no-name or “unlocked” boxes. If a box seems suspect, the suggested steps are to disconnect it or replace it and keep TV devices on a separate guest network. Uninstalling an app or rebooting should not be treated as proof that the firmware backdoor is gone.
Organizations can review which streaming devices connect to office networks and avoid relying on an IP address’s reputation as the sole basis for trust. Further clarity would depend on product identification guidance, any device-specific cleanup or replacement instructions, and updates from Google, investigators or Videostrong.
Key Questions
What was the XCPE botnet?
Google described XCPE as a botnet built around a firmware backdoor in Android set-top boxes. It said operators used infected devices for residential proxy traffic, ad fraud and other remote tasks.
How many devices were counted?
Google said the botnet involved more than 1.3 million set-top boxes. TrendAI counted 1,472,554 infected devices from June 3 to October 1, 2026, and said its count was a lower bound.
Does uninstalling the suspicious app remove the backdoor?
Google says the backdoor can restore itself from a protected firmware partition after a reboot. Removing an app through the device interface may not remove it.
Could a Google-certified box be affected?
Google says some infected boxes were certified and alleges malicious code was loaded after the first boot to evade review. The source material does not name every affected model or establish that all certified devices were affected.
What should owners do?
Check the device’s Play Protect certification, disconnect or replace a box you suspect is compromised, and consider keeping TV devices on a separate guest network. Certification by itself does not establish whether a particular unit was affected.
Source: Thorsten Meyer AI
