TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Google and industry partners say they disrupted the XCPE botnet in late October 2026 by taking down servers that controlled infected Android TV boxes. Google attributes the firmware backdoor to device maker Videostrong; infected boxes may retain it after the disruption, and the extent of its continuing effects is unclear.
Google said it coordinated the operation with Japan’s National Police Agency and security firms Lumen, HUMAN Security, Plume, Synthient and TrendAI. In its report, Google said legal action targeted domains and servers used to control XCPE and distribute malware. It also said control servers for more than a dozen malware families installed as add-ons were taken down. Google did not publish the court filing or identify a public case number in the material provided.
The reported infections were counted over a defined period. TrendAI recorded 1,472,554 infected devices between June 3 and October 1, 2026, describing that figure as a lower bound. Google separately described the botnet as involving more than 1.3 million set-top boxes. These figures refer to infected devices, not confirmed individual owners or households.
Google said infected boxes were used mainly as residential proxies, routing other parties’ traffic through owners’ internet connections, and for ad fraud. It also reported that operators could capture live screenshots, simulate keystrokes, collect account and device information, open remote shells and scan local networks. Those are capabilities Google observed or attributed to the operators; the report does not establish that every infected box was used for every listed purpose.
Google Disrupts the XCPE Botnet A backdoor may remain on TV boxes
Google and industry partners took down servers used to control infected Android TV boxes. The disruption cut off remote control, but may not remove the firmware backdoor.
How the backdoor worked
Google says firmware-level access let the system app contact a control server and receive instructions or additional software.
A small system app shipped inside affected boxes with system-level access.
It contacted a control server and could install more software.
Google says it could return from a protected partition after a reboot.
What operators could do
Google reported these capabilities; it did not say every infected box was used for each one.
Route traffic
Use boxes as residential proxies through owners’ internet connections.
Commit ad fraud
Use infected devices for advertising-related fraud.
Inspect and control
Capture screenshots, simulate keystrokes, collect information, open remote shells and scan local networks.
What the takedown changed
- Control infrastructure for XCPE was targeted.
- Servers for more than a dozen add-on malware families were also taken down.
- Google says the action cut off remote control.
- The firmware backdoor may remain on infected boxes.
- It may reinstall after a reboot.
- How many devices remain infected is unclear.
What owners and businesses can do
A streaming box can affect the network it connects to, even if it is not a conventional computer.
- Check whether the box is Play Protect certified.
- If you suspect infection, disconnect or replace the box.
- Consider placing TV boxes on a separate guest network.
- Uninstalling an app may not remove a firmware-level backdoor; the source material gives no guaranteed removal method.
A Backdoor Inside Certified TV Boxes
The case matters because the access was reportedly embedded in device firmware before boxes reached consumers. Owners may have used an apparently ordinary streaming device while its internet connection served other parties. Google said some affected devices were Google-certified, indicating that certification did not prevent this supply-chain compromise in those cases.
Google said Videostrong used obfuscation to evade checks by loading malicious code after a device’s first boot. The company has barred Videostrong and future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors, and said it has tightened firmware integrity checks. Those steps address certification and review; they do not themselves remove the backdoor from boxes already sold.
Google also estimated that taking down control servers for the add-on malware could cut off access to at least 10 million additional compromised devices. That is Google’s estimate, not a verified device count, and reporting cited in the source material says the devices do not all run Android. For businesses, the incident is a reminder that connected devices on home or office networks can carry risk even when they are not conventional computers.
Products Worth Considering
LG UltraGear 32GX870A-B 32-inch 4K OLED Gaming Monitor
LG UltraGear 27G640A-B 27-Inch QHD IPS Gaming Monitor, 300Hz, 1ms, G-SYNC Compatible, FreeSync Premium, DisplayHDR 400
LG UltraGear 45GX900A-B 45-Inch Curved OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How XCPE Reached the Boxes
Google’s report, “Shutting the Door on the XCPE Botnet,” describes a small system application, identified in some builds as x.cpe or com.oemservice, embedded in firmware with system-level access. According to Google, it contacted a control server when the box started and could receive instructions and additional software. If removed by a user, the application could reinstall from a protected partition after a reboot.
Google said the backdoor disabled Google Play Protect app checks before installing other software. Since at least late 2024, the system had a stub that communicated with the server, a separate loader and additional modules supplied by criminal partners, according to the report. In August 2026, Google observed droppers disguised as Android system apps replacing the loader, which it interpreted as an effort to maintain concealment.
The source material says Videostrong did not respond to requests for comment from The Record and heise. Google’s attribution is therefore presented as the company’s assessment; no response from Videostrong is included in the available material.
““The backdoor and the botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group
What the Takedown Leaves Behind
The disruption targeted the control infrastructure, but the firmware backdoor may persist on infected boxes and can reinstall after a reboot, according to Google. The available source material does not establish how many devices remain infected, whether every control server was disabled, or whether operators have found another way to communicate with affected boxes.
Google’s claims about Videostrong and the estimated effect on at least 10 million additional devices have not been independently verified in the material provided. The public court filing, case details and Videostrong’s response were not available. It is also unclear how many owners were affected by proxy traffic, ad fraud or the other capabilities described by Google.
Checking and Replacing Affected Boxes
Google says it has changed its review process for certified Android TV devices and barred Videostrong from future participation in the certified program. The source material does not give a date for further legal proceedings or report a schedule for additional findings.
Owners can check whether a box is Play Protect certified and be cautious with no-name or “unlocked” devices. Because uninstalling an app may not remove a firmware-level backdoor, Google’s reported findings support treating a suspected box as untrusted: disconnect or replace it and keep TV boxes on a separate guest network. The source does not identify a complete consumer removal method.
Key Questions
What happened to the XCPE botnet?
Google and partners said they took down servers used to control the botnet in late October 2026. Google published its account on November 2.
How many devices were affected?
Google described more than 1.3 million set-top boxes. TrendAI counted 1,472,554 infected devices from June 3 to October 1, 2026, and called that a lower bound.
Who does Google say was behind the backdoor?
Google attributed the backdoor to Videostrong Technology with high confidence. The source material says the company did not respond to requests for comment from The Record and heise.
Does taking down the servers remove the malware?
No. Google said the backdoor can remain in the firmware and reinstall after a reboot, so removing an app may not clear it.
What should owners of a suspicious box do?
Check its Play Protect certification, disconnect or replace it if you suspect it is affected, and consider placing TV boxes on a separate guest network. The source material does not provide a guaranteed removal procedure.
Source: Thorsten Meyer AI
