🔍 Read the full analysis: From Factory To Botnet: The Malware Campaign Affecting TV Boxes on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Google and industry partners disrupted control servers for the XCPE botnet in late October, after Google said it had infected more than 1.3 million set-top boxes. Google alleges that device maker Videostrong built and operated the firmware backdoor for profit; the company did not respond to media requests cited in the source report. The disruption cuts off remote control, but the backdoor may persist on affected devices.
Google and industry partners disrupted the control servers for the XCPE botnet in late October, after the company said malicious firmware had turned more than 1.3 million Android set-top boxes into tools for proxy traffic, ad fraud and other remote activity. Google says, with high confidence, that manufacturer Videostrong Technology Co. built and operated the backdoor for profit; that allegation has not been answered by the company in media requests cited in the source report.
Google’s Threat Intelligence Group published its account on November 2, saying the operation was carried out with Japan’s National Police Agency and security companies Lumen, HUMAN Security, Plume, Synthient and TrendAI. Google says it took legal action to disable domains and servers used to control XCPE and deliver malware, and acted against control servers for more than a dozen malware families that had been added to the boxes.
The scale figures have different bases. Google described the botnet as involving more than 1.3 million set-top boxes. TrendAI counted 1,472,554 infected devices between June 3 and October 1, 2026, and characterized that figure as a lower bound. Google also estimates that disabling servers for the add-on malware could cut access to at least 10 million other compromised devices. That is an estimate, not a device count, and the source report says those devices do not all run Android.
According to Google, the backdoor was embedded in device firmware, giving it system-level access. A small system app, identified in some builds as x.cpe and in others as com.oemservice, contacted control servers and could receive commands or install additional apps. Google says the malware could route outside traffic through owners’ internet connections and generate fraudulent ad activity. It also observed capabilities including taking screenshots, injecting keystrokes, collecting account and device information, scanning local networks and opening remote shells.
Google says the backdoor could return after a reboot if removed because it was restored from a protected partition. It also says the operators used obfuscation to load malicious code after a device’s first boot, a method that helped some affected boxes pass certification checks. Google has barred Videostrong and future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors, and says it has tightened firmware-integrity checks.
Infographic 01 · XCPE in numbers
A botnet that shipped from the factory
Google says the device maker Videostrong built the backdoor into its own firmware and sold access. That is Google’s assessment; Videostrong did not respond to the press.
set-top boxes in the XCPE botnet, the joint figure of Google and its partners. Taken down in late October 2026.
- 1,472,554 infected devices in TrendAI’s own telemetry, 3 Jun to 1 Oct 2026, a lower bound.
- Partner counts differ by snapshot and view, so the joint figure is “more than 1.3 million”.
- 10M+ more devices lost their malware’s control servers: Google’s estimate, not a count.
How one box earns money for criminals
- Built inA system app sits in the firmware and reinstalls itself after a reboot
- Phones homeOn start it fetches settings and keeps a line open to a control server
- Sold onAccess is sold to partners, who push their own modules
- Cashed inResidential proxy, hidden ad views, more backdoors
Your home internet address is the product. Strangers rent it, and their traffic looks as if it came from your living room.
Sources: Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026. Simplified for readers; no indicators or technical details reproduced.
Powered by Thorsten Meyer AI
Why the Firmware Backdoor Matters
The reported method changes the risk for owners: the compromise was present in firmware, rather than depending only on someone clicking a link or installing a visibly suspicious app. If Google’s account is accurate, buyers could receive a device that appeared to be an ordinary streaming box but could be remotely directed to use their internet connection or perform other tasks.
That matters beyond the TV. Residential proxy traffic can make activity appear to originate from a household or office network, potentially complicating investigations and security monitoring. Google’s report also describes capabilities that could expose information on the box or enable access to other devices on a local network. The source material does not establish that every listed capability was used against every infected owner, so the distinction between technical capability and confirmed activity remains important.
The case also raises questions for device certification and supply chains. Google says malicious code was loaded after initial boot to evade checks, and that some infected boxes were certified. Its ban and updated review process address its own certification system, but the account does not establish how many devices remain in use or whether other manufacturers used similar methods.
Popular right now
TCL 65-Inch T7 Series 4K QLED Smart Google TV, 144Hz (65T7)
TCL 65 Inch QM8L Series SQD-Mini LED QLED 4K Smart Google TV
eufy C28 Robot Vacuum Cleaner and Mop for Pet Hair, 15,000 Pa
As an affiliate, we earn on qualifying purchases.
How XCPE Reached TV Boxes
Google describes Videostrong as an Android original equipment and design manufacturer: a company that can build devices under its own name or for other brands. Its report says the XCPE backdoor and botnet were intentionally developed, deployed and operated for financial gain. That is Google’s finding and accusation; the source material does not include a public court filing or case number that would independently document the legal proceedings.
The botnet’s software had several layers, according to Google: a system-level component that communicated with the server, a loader and additional modules supplied by affiliates. The operators used the boxes for more than one purpose. Most notably, Google identified residential proxy use and ad fraud; it also described remote-control functions. The report says the design dates back at least to late 2024, while new droppers disguised as Android system apps appeared in August 2026.
Google’s response included action against XCPE’s control infrastructure and servers tied to other malware families found as add-ons. The company says the partners’ work also limited access to those other compromised devices. That wider impact is separate from the count of TV boxes in XCPE and is presented by Google as an estimate.
“The backdoor and the botnet were “intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group
What the Takedown Does Not Resolve
The number of affected devices still online is unknown from the source material, as is how many owners have received a clean firmware replacement. Disabling control servers disrupts the operators’ remote access, but it does not by itself remove code already stored on a box. Google says the backdoor can reinstall after a reboot, and the source report warns that uninstalling an app will not remove it.
Google’s attribution to Videostrong is a company finding described as high confidence, not a response from the manufacturer. Videostrong did not respond to requests for comment from The Record and heise, according to the source material. It also says Google did not publish the court filing and that the author could not locate a public case record. Details of the legal action, including a court and case number, are therefore not supplied.
The source material does not identify a complete list of affected models, brands or retail channels, nor does it quantify how many owners experienced each type of abuse. It also does not show that every device with the relevant software was used for every activity described. Google’s estimate of at least 10 million additional devices has no detailed breakdown in the supplied material and includes devices that may not run Android.
What Owners and Google Should Do
Google says it has banned Videostrong from its certified Android device program and tightened firmware-integrity reviews. The source material does not give a timeline for further enforcement steps or describe a consumer notification program. Owners who suspect a box is affected can check whether it is Play Protect certified, but certification alone should not be treated as proof that a device is free of the reported issue.
The source report advises treating a suspicious or unrecognized box as untrusted: disconnect it or replace it, and place TV boxes on a separate guest network where possible. It also recommends caution with no-name or “unlocked” devices. Businesses should account for home and office internet-connected devices in security planning and avoid relying on IP reputation alone, since proxy traffic can make activity appear to come from an ordinary connection.
Further clarity depends on Google or law enforcement publishing more details, affected-device makers identifying models and firmware versions, and researchers tracking whether the disrupted servers stay offline. For users, the practical question is whether their specific device contains the backdoor and whether a safe firmware remedy exists; the supplied source material does not provide a definitive model-by-model check.
Key Questions
What is the XCPE botnet?
XCPE is a botnet Google says used compromised Android set-top boxes. Its operators could direct infected devices through control servers, including for residential proxy traffic and ad fraud.
How many TV boxes were affected?
Google said the botnet involved more than 1.3 million set-top boxes. TrendAI counted 1,472,554 infected devices from June 3 to October 1, 2026, calling that a lower bound. The figures describe the campaign during the stated reporting period, not necessarily the number still infected today.
Did Google say the manufacturer was responsible?
Yes. Google says with high confidence that Videostrong Technology Co. built and operated the backdoor for profit. That is Google’s allegation; the source material says Videostrong did not respond to requests for comment cited by The Record and heise.
Does the server takedown remove malware from a box?
Not necessarily. Google says the disruption cut off control infrastructure, while the backdoor can remain in firmware and reinstall after a reboot. The source material says removing the app alone does not remove the underlying backdoor.
What should owners do if they are concerned?
Check the device’s Play Protect certification, be cautious with unknown or “unlocked” boxes, and consider disconnecting or replacing a suspicious device. The source report also recommends placing TV boxes on a separate guest network; it does not provide a complete list of affected models.
Source: ThorstenMeyerAI.com
