🔍 Read the full analysis: How Malware Linked To The Factory Spread Across TV Boxes on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Google said on Nov. 2 that it and industry partners had disrupted the XCPE botnet, which affected more than 1.3 million set-top boxes. Google attributes the firmware backdoor to device maker Videostrong, but the malware reportedly remains on infected boxes and can return after a reboot.
Google and industry partners disrupted the XCPE botnet in late October, cutting off control servers used to reach more than 1.3 million Android TV boxes, Google said Nov. 2. The company alleges with high confidence that device maker Videostrong Technology built and operated a backdoor in device firmware, allowing infected boxes to be used for residential proxy services, ad fraud and other remote activity.
Google’s Threat Intelligence Group said it coordinated with Japan’s National Police Agency and security companies Lumen, HUMAN Security, Plume, Synthient and TrendAI. Google reported that legal action targeted domains and servers used to control XCPE and distribute malware add-ons, as well as control servers associated with more than a dozen other malware families. The company also said it barred Videostrong and any future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors.
TrendAI counted 1,472,554 infected devices between June 3 and Oct. 1, 2026, describing its figure as a lower bound. Google’s own description was “more than 1.3 million set-top boxes.” Google also estimated that taking down servers used by add-on malware could cut off access to at least 10 million additional compromised devices. That is an estimate, not a direct count, and the affected devices do not all necessarily run Android.
Google said the firmware backdoor remained after the server disruption. Its report describes a system app, identified in some builds as x.cpe or com.oemservice, with elevated privileges. The app reportedly contacts a control server when the box starts, can fetch instructions and install other software, and restores itself from a protected partition if removed and the device is rebooted. Google said the operators could also capture screenshots, inject keystrokes, collect account and device information, and open remote shells.
Infographic 01 · XCPE in numbers
A botnet that shipped from the factory
Google says the device maker Videostrong built the backdoor into its own firmware and sold access. That is Google’s assessment; Videostrong did not respond to the press.
set-top boxes in the XCPE botnet, the joint figure of Google and its partners. Taken down in late October 2026.
- 1,472,554 infected devices in TrendAI’s own telemetry, 3 Jun to 1 Oct 2026, a lower bound.
- Partner counts differ by snapshot and view, so the joint figure is “more than 1.3 million”.
- 10M+ more devices lost their malware’s control servers: Google’s estimate, not a count.
How one box earns money for criminals
- Built inA system app sits in the firmware and reinstalls itself after a reboot
- Phones homeOn start it fetches settings and keeps a line open to a control server
- Sold onAccess is sold to partners, who push their own modules
- Cashed inResidential proxy, hidden ad views, more backdoors
Your home internet address is the product. Strangers rent it, and their traffic looks as if it came from your living room.
Sources: Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026. Simplified for readers; no indicators or technical details reproduced.
Powered by Thorsten Meyer AI
Why TV Box Firmware Matters
The case shifts attention from users’ downloads to the device supply chain. If Google’s account is accurate, owners did not need to click a malicious link or install a fake app for their boxes to become part of the botnet: the backdoor was placed in firmware before the devices reached them. That can make ordinary consumer electronics an entry point for criminal services without obvious signs on the screen.
Residential proxy services route a customer’s internet traffic through another person’s connection. That can make outside activity appear to originate from an infected household or office, potentially exposing the owner’s IP address to activity they did not initiate. Google and its partners also described ad fraud and other remote capabilities, although the report does not establish that every infected box performed every listed action.
The takedown may have interrupted operators’ access, but it does not by itself clean devices. Google’s description that the backdoor can survive removal and return after a reboot means affected owners may need to treat the hardware as untrusted. For organizations, the incident also shows why connected devices on home or office networks should not be assumed safe simply because they are appliances rather than computers.
Products Worth Considering
Apple Watch SE 3 GPS Smartwatch, 40mm
Bose TV Speaker (2nd Gen) Compact Soundbar
Apple MacBook Air 15-inch with M5 chip, 16GB Memory, 512GB SSD, and Liquid Retina Display
As an affiliate, we earn on qualifying purchases.
How the XCPE Infection Spread
Google’s Nov. 2 report says the backdoor was embedded in firmware on inexpensive Android TV boxes made by Videostrong, an original equipment and design manufacturer that builds devices for its own brands and other companies’ brands. Google said some infected devices had Google certification. It alleges Videostrong used obfuscation and loaded malicious code after a device’s first boot to evade review checks. Google said it has since changed its firmware-integrity review process.
The system app acted as a foothold, while separate loaders and add-on modules supplied functions and ways to make money. Google said the design had three layers by late 2024. In August 2026, it observed new droppers disguised as Android system apps replacing the loader, which the report interpreted as an effort to remain hidden. The add-ons were supplied by affiliates, according to Google, rather than all being part of one single malware component.
Google said most of the observed activity involved residential proxy use and ad fraud. Its report also described remote commands and data collection. The scale figures refer to different measurements: TrendAI’s device count covers a stated June-to-October window, while Google’s “more than 1.3 million” is a rounded description. The separate estimate of at least 10 million additional devices concerns other malware families and should not be added to the XCPE count as if it were a verified total.
“The backdoor and the botnet “were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group
What the Takedown Did Not Remove
The control-server disruption does not establish that every infected device has been cleaned or that all malicious activity has stopped. Google’s report says the backdoor remains in firmware and can reinstall itself after a reboot. The source material does not describe a reliable software-only removal method for owners, nor does it give a complete list of affected models, brands or regional sales channels.
Videostrong did not respond to requests for comment from The Record and heise, according to the source material. Google’s allegation has not been accompanied there by a publicly available court filing or case record; no court, case number or ruling is identified. The precise number of devices still infected after the disruption is also not stated. Google’s estimate of at least 10 million additional compromised devices concerns malware distributed through other channels and remains an estimate rather than a confirmed census.
Steps for Owners and Google
Google says it has barred Videostrong from the certified Android device program and tightened firmware checks. The company has not specified in the supplied report when those changes will be fully applied across certified-device reviews or whether it will publish a list of affected products. Further information about the legal action, the targeted servers and the remaining device population would help clarify the takedown’s reach.
Owners can check whether a TV box is Play Protect certified, but certification alone should not be treated as proof that a device is unaffected: Google said some infected boxes had been certified. The source advises treating suspicious or no-name devices as untrusted, unplugging or replacing them, and placing TV boxes on a separate guest network. Businesses should include connected devices in network risk reviews and avoid relying solely on an IP address’s reputation when investigating suspicious traffic.
Key Questions
What was the XCPE botnet?
XCPE was a network of compromised TV boxes that Google said could be remotely controlled. The devices were used mainly as residential proxies and for ad fraud, with additional remote capabilities described in Google’s report.
How many TV boxes were affected?
Google said the botnet involved more than 1.3 million set-top boxes. TrendAI counted 1,472,554 infected devices from June 3 to Oct. 1, 2026, and called that a lower-bound figure.
Does the server takedown remove the malware?
No. Google said the disruption cut off control servers, but the backdoor remains in device firmware and may reinstall after a reboot. The supplied report does not provide a confirmed software-only cleanup method.
Did Google say Videostrong was responsible?
Google said with “high confidence” that Videostrong built and operated the backdoor for financial gain. That is Google’s allegation; the source material does not identify a public court ruling, filing or case number.
What should owners of a suspicious TV box do?
The source advises checking Play Protect certification, unplugging or replacing a suspicious device, and connecting TV boxes to a separate guest network. Certification is not a guarantee of safety, since Google said some infected boxes were certified.
Source: ThorstenMeyerAI.com
