🔍 Read the full analysis: How Google Responded To Factory-Linked Malware On TV Boxes on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Google and industry partners disrupted the control infrastructure for XCPE, a botnet affecting more than 1.3 million set-top boxes, according to Google. The company attributes the firmware backdoor to Shenzhen-based Videostrong, which it has barred from supplying certified Android devices; the backdoor may remain on infected boxes after the takedown.
Google says it and its partners disrupted XCPE, a botnet linked to more than 1.3 million Android set-top boxes, and barred the device maker it blames from building certified Android products. The company said the malware was built into device firmware before sale, meaning owners could be affected without installing a malicious app or clicking a harmful link.
Google’s Threat Intelligence Group (GTIG) reported on November 2 that it worked with Japan’s National Police Agency and security firms to take down domains and servers used to control XCPE and distribute malware. Google says the action took place in late October. The partners included Lumen, HUMAN Security, Plume, Synthient and TrendAI.
Google attributes the backdoor to Videostrong Technology Co., a Shenzhen-based Android device maker, and says with “high confidence” that the company developed and operated it for financial gain. Google says Videostrong sold access to criminal partners. The company did not respond to requests for comment from The Record and heise, according to the source material; the allegation has not been independently established here.
Google also says it pursued legal action against servers used by more than a dozen malware families that were added to some boxes. It estimates that shutting down those servers could cut access to at least 10 million additional compromised devices. That is Google’s estimate, not a device count, and the affected devices are not all necessarily Android products.
TrendAI counted 1,472,554 infected devices between June 3 and October 1, 2026, describing its figure as a lower bound. Google separately described XCPE as involving more than 1.3 million set-top boxes. These figures refer to different reporting and counting descriptions; the available material does not give a common method for comparing them.
Infographic 01 · XCPE in numbers
A botnet that shipped from the factory
Google says the device maker Videostrong built the backdoor into its own firmware and sold access. That is Google’s assessment; Videostrong did not respond to the press.
set-top boxes in the XCPE botnet, the joint figure of Google and its partners. Taken down in late October 2026.
- 1,472,554 infected devices in TrendAI’s own telemetry, 3 Jun to 1 Oct 2026, a lower bound.
- Partner counts differ by snapshot and view, so the joint figure is “more than 1.3 million”.
- 10M+ more devices lost their malware’s control servers: Google’s estimate, not a count.
How one box earns money for criminals
- Built inA system app sits in the firmware and reinstalls itself after a reboot
- Phones homeOn start it fetches settings and keeps a line open to a control server
- Sold onAccess is sold to partners, who push their own modules
- Cashed inResidential proxy, hidden ad views, more backdoors
Your home internet address is the product. Strangers rent it, and their traffic looks as if it came from your living room.
Sources: Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026. Simplified for readers; no indicators or technical details reproduced.
Powered by Thorsten Meyer AI
The Backdoor Survives a Server Takedown
The disruption matters because the affected boxes could use their owners’ internet connections without their knowledge. Google says the devices were mainly used as residential proxies, routing other people’s online activity through a household connection, and for ad fraud. That can make activity appear to come from an ordinary home or office, complicating efforts to identify who is behind it.
GTIG also says operators could capture live screenshots, inject keystrokes, collect account and device information, open remote shells and scan local networks. Those capabilities indicate potential access beyond ad fraud, although the source material does not establish how often each was used or whether particular owners suffered account theft or other direct harm.
The server takedown is not the same as cleaning every device. Google says the backdoor remains in firmware and can reinstall itself after a reboot if removed as an app. For affected users, cutting off remote control does not necessarily remove the underlying foothold. That distinction matters to households and businesses that may treat a streaming box as a low-risk appliance.
Products Worth Considering
HP Sprocket Portable 2×3 Instant Photo Printer, Lilac, with ZINK Paper Bundle
Logitech MX Mechanical Wireless Illuminated Keyboard, Tactile Quiet, Graphite
Dell UltraSharp 27 Thunderbolt Hub Monitor (U2726DER), QHD
As an affiliate, we earn on qualifying purchases.
How the Firmware Backdoor Worked
According to GTIG, the malicious system app was called x.cpe in some builds and com.oemservice in others. It had system-level privileges and was stored in firmware. The report says that if a user removed the app, it could be restored from a protected partition when the box restarted. On startup, the device contacted a control server for instructions.
Google says the malware could silently install additional apps and run commands. Before installing other apps, it disabled checks by Google Play Protect, Android’s harmful-app detection feature. Since at least late 2024, GTIG says the system had separate components for contacting the server, loading code and running revenue-generating modules. Google reported that new droppers disguised as Android system apps appeared in August 2026, which it interpreted as an effort to maintain concealment.
Some affected boxes had Google certification, according to the company. Google says Videostrong used obfuscation to evade testing by loading malicious code after a device’s first boot. In response, Google says it barred Videostrong and future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors, and changed its checks of firmware integrity.
““The backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group
Infection Cleanup Remains Unclear
The available reports do not identify every affected model, brand, seller or country, so owners cannot rely on the figures alone to determine whether a particular box was infected. Nor does the source material say how many devices remain online or how many owners have removed or replaced them.
Google has not publicly released the court filing cited in its account, and the source material identifies no public case number or court. Videostrong’s response is also not available: the cited reports said it did not respond to requests for comment. The company’s alleged role and financial motive should therefore remain attributed to Google.
Google’s estimate concerning at least 10 million additional devices describes the potential effect of disabling control servers for other malware families. It is not a measured total of devices cleaned or disconnected, and the material says some of those devices may not run Android. The precise scope of that wider disruption is not established.
Check Devices and Network Exposure
Google says it has changed its review process for certified Android TV firmware and blocked Videostrong from supplying certified products. It has not provided, in the material available, a public list of affected models or a device-by-device removal process. Owners should check a box’s Play Protect certification and treat unfamiliar, no-name or “unlocked” devices cautiously; certification alone is not proof that a device is unaffected.
Because the backdoor may remain in firmware, Google and the cited reporting advise treating a suspected device as untrusted: disconnect or replace it rather than relying on an app uninstall. Keeping TV boxes on a separate guest network can limit their access to other devices. Businesses should include home and office internet-connected devices in security reviews and avoid relying only on IP reputation, since proxy traffic can come from ordinary residential addresses.
The next clear milestones would be further information about affected devices, any public legal filings, and updates from Google or its partners on the reach of the takedown. Until those details are available, the number of boxes still compromised and the practical remediation options for specific models remain unresolved.
Key Questions
What is XCPE?
XCPE is a botnet that Google says used a firmware backdoor in Android set-top boxes to receive remote instructions and run additional malware.
How many devices were affected?
Google described more than 1.3 million set-top boxes. TrendAI counted 1,472,554 infected devices from June 3 to October 1, 2026, and called that a lower bound. The figures are attributed to their respective sources.
Does the takedown remove malware from an infected box?
Not necessarily. Google says the takedown disrupted control servers, but the backdoor remains in firmware and can reinstall after a reboot. Removing an app alone may not clean the device.
What did Google do about Videostrong?
Google says it barred Videostrong and future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors. It also says it changed firmware-integrity checks. The allegation that Videostrong operated XCPE is Google’s claim.
What should owners do if they suspect their TV box is affected?
Check the device’s certification, disconnect or replace a suspicious box, and consider putting TV devices on a separate guest network. Google has not provided a complete public list of affected models in the source material.
Source: ThorstenMeyerAI.com
