TL;DR
Get home appliances delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Google said on Nov. 2 that it worked with industry partners and Japan’s National Police Agency to disrupt the XCPE botnet, which involved more than 1.3 million set-top boxes. The malware was reportedly installed in device firmware, so cutting off its control servers does not remove the backdoor from affected boxes.
Google’s Threat Intelligence Group (GTIG) said the operation took down domains and servers Videostrong used to control XCPE and distribute malware. Google also said it pursued action against control servers used by more than a dozen malware families that had been installed on the boxes as add-ons. The operation involved security firms Lumen, HUMAN Security, Plume, Synthient and TrendAI, alongside Japan’s National Police Agency.
TrendAI counted 1,472,554 infected devices from June 3 to Oct. 1, 2026, and described that figure as a lower bound. Google’s headline estimate was more than 1.3 million set-top boxes. Google says the devices were used mainly as residential proxies, routing other people’s internet traffic through owners’ home connections, and for ad fraud. GTIG also reported operators could capture screenshots, inject keystrokes, collect account and device information, and open remote shells.
According to Google, a system app embedded in device firmware contacted a control server and could silently install additional software. The company says the backdoor could reinstall itself from a protected partition after a reboot if a user removed the app. Google reported that some affected boxes had been certified for Android, and said Videostrong used obfuscation to load malicious code after the initial certification checks. Google says it has barred Videostrong and future affiliates from building certified Android devices or supplying software to certified vendors, and has tightened firmware integrity checks.
Google disrupts XCPE TV box botnet
Google and partners cut off the botnet’s control servers, but the firmware backdoor may remain on affected devices. Owners and businesses should treat suspicious boxes as untrusted.
What the takedown changed
The operation disrupted XCPE’s remote control and malware distribution infrastructure.
- Domains and servers used to control XCPE were taken down.
- Partners also targeted servers used by more than a dozen malware families.
- Malware embedded in firmware may remain after the server disruption.
- A protected partition may restore the backdoor after reboot.
How compromised boxes were used
Operators could use devices for profit and gain remote access.
Residential proxies
Boxes routed other people’s internet traffic through household connections.
Ad fraud
Google says the devices were also used to support ad fraud.
Remote capabilities
Operators could capture screenshots, inject keystrokes, collect information and open remote shells.
What owners and businesses can do
Certification alone may not establish whether an older device was exposed.
Check whether the box is Play Protect certified, while recognizing that some infected boxes had been certified.
If a box seems suspicious or cannot be verified, disconnect or replace it.
Place streaming boxes on a separate guest network and include connected devices in security planning.
The Firmware Backdoor Persists
The takedown disrupts the operators’ remote control, but it does not, on the information Google has released, clean the affected boxes. If the backdoor remains in firmware and returns after a reboot, users may not be able to remove it by uninstalling an app. The practical concern extends beyond streaming: a compromised box can route third-party traffic through a household or office connection and expose information or devices on the local network.
Google’s account also raises questions for buyers who rely on Android certification as a sign that a device has passed security checks. Google says some infected models were certified, and that the code was loaded after initial checks. Its reported changes address the review process, while the details of how owners can identify and remediate specific affected models remain limited.
Google further estimated that disabling the add-on malware control servers could cut off access to at least 10 million additional compromised devices. That is Google’s estimate of a wider effect, not a verified count of devices cleaned or a figure limited to Android boxes. The source material says some of those devices may not run Android.
Products Worth Considering
Amazon Kindle Paperwhite Signature Edition, 32GB (2024), Metallic Black
Amazon Kindle Scribe (64GB) with Premium Pen, Metallic Jade
DJI Osmo Mobile 8 Smartphone Gimbal with Mic Mini Transmitter, Infinity Black
As an affiliate, we earn on qualifying purchases.
How XCPE Reached TV Boxes
Google’s report, titled “Shutting the Door on the XCPE Botnet,” was published on Nov. 2, 2026. It describes Videostrong as an Android original equipment and original design manufacturer, meaning it builds devices under its own name and for other brands. Google says the backdoor had a small system app component, identified in some builds as x.cpe or com.oemservice, and that the campaign’s design had included a stub, a loader and modules used to make money.
Google says the backdoor had been present since at least late 2024. It reported that new droppers disguised as Android system apps began replacing the loader in August 2026. According to GTIG, the devices contacted control servers to receive settings and instructions, while operators could add malware supplied by criminal partners.
The source material says Google took legal action involving the relevant domains and servers, but does not identify a court or case number. Reporting cited in the source material said Videostrong did not respond to requests for comment from The Record and heise. No company statement is included in the available account.
““more than 1.3 million set-top boxes””
— Google Threat Intelligence Group
Owners and Device Models Unknown
The available account does not name all affected brands or models, or give a method to determine whether a particular box was part of the 1.3 million-plus total. It is also unclear how many infected devices remain online after the server disruption, how many owners will need to replace their boxes, and whether manufacturers beyond Videostrong were involved. Google’s estimate for additional compromised devices does not specify a confirmed count or establish that all are Android devices.
Google alleges that Videostrong operated the backdoor for profit and sold access to criminal partners. The company’s response was not included in the source material. The account also does not provide public court records or detail the legal proceedings behind the server takedowns.
Check Certification and Isolate Boxes
Google says it has banned Videostrong from its certified Android device program and changed firmware review checks. The source material does not give a timeline for those changes or name a public list of affected products. Owners can check whether a box is Play Protect certified, but certification alone may not resolve whether an older device was exposed, given Google’s report that some infected boxes had been certified.
For a box that is suspicious or cannot be verified, the source material recommends treating it as untrusted: disconnect or replace it, and keep streaming devices on a separate guest network. Businesses should account for connected TV boxes and other IoT devices in their network security planning. The next clear indicators will be any further device lists, remediation guidance, or updates from Google, Videostrong, law enforcement or the security partners.
Key Questions
What did Google take down?
Google says it and its partners disrupted the XCPE control infrastructure, including domains and servers used to control the botnet and distribute malware.
How many TV boxes were involved?
Google reported more than 1.3 million set-top boxes. TrendAI counted 1,472,554 infected devices between June 3 and Oct. 1, 2026, and called its count a lower bound.
Does the takedown remove malware from an infected box?
Not necessarily. Google says the backdoor can remain in firmware and reinstall after a reboot, so disrupting control servers does not itself clean the device.
Did Google say certified Android boxes were affected?
Yes. Google said some infected boxes were Android-certified and alleged that malicious code was loaded after initial certification checks.
What should owners do if they suspect their box is affected?
Check the device’s Play Protect certification and treat a suspicious box as untrusted. The source material recommends unplugging or replacing it and placing TV boxes on a separate guest network.
Source: Thorsten Meyer AI
