Most malware sneaks onto a device after you buy it. The XCPE botnet came already installed. Google says a China-based company that was approved to build certified Android devices deliberately hid a backdoor in the firmware of its TV set-top boxes, then sold access to those boxes to criminal groups. On November 2, Google announced it had taken the operation apart, cut off more than 1.3 million infected devices and banned the manufacturer, Videostrong Technology, from the Android ecosystem.
Quick answer: Google’s Threat Intelligence Group disrupted XCPE, a backdoor built into the firmware of Android TV set-top boxes made by Videostrong Technology. More than 1.3 million devices in over 170 countries were enrolled, and Google says the action also cut criminals off from at least 10 million other compromised devices. Google took legal action against the botnet’s servers, banned Videostrong and any future subsidiaries from certified Android, and tightened its device checks.
What happened
Google Threat Intelligence Group (GTIG) published its findings on Monday, November 2, 2026. It attributes the XCPE operation, with high confidence, to Videostrong Technology Co., an Android device maker that sold TV set-top boxes and other hardware.
According to GTIG, this was not a case of one rogue employee or a sloppy software build. “We believe this campaign wasn’t an isolated rogue insider or a development oversight,” the researchers wrote in their report. Instead, the company is accused of selling access to its customers’ devices to criminal “affiliates”, who then loaded their own malicious modules onto the boxes.
Google responded on several fronts:
- Legal action to shut down the domains and servers used to control the botnet and deliver modules.
- Takedowns of command-and-control infrastructure for more than a dozen separate malware families that were riding on the backdoor.
- A ban on Videostrong, plus any future subsidiaries and affiliates, from building certified Android devices or supplying software to certified vendors.
- Tighter checks, including stronger firmware integrity checks for certified Android TV devices and changes to the review process for device makers.
Google worked with Japan’s National Police Agency, Lumen Technologies, HUMAN Security, Plume, Synthient and TrendAI on the disruption.
Key facts at a glance
| Detail | What we know |
|---|---|
| Name | XCPE (the backdoor package is named x.cpe, also com.oemservice) |
| Accused maker | Videostrong Technology Co., a China-based Android device maker |
| Devices in the botnet | More than 1.3 million, mostly Android TV set-top boxes |
| Other devices cut off | At least 10 million more compromised devices from various makers |
| Reach | More than 170 countries; largest clusters in Malaysia, Brazil, Iraq, Mexico and Taiwan |
| US infections | Nearly 44,000 between June and October 2026 |
| Other affected hardware | Telehealth devices, karaoke machines and digital signage |
| Announced | November 2, 2026, by Google Threat Intelligence Group |
How the XCPE backdoor worked
The clever, and alarming, part is how XCPE slipped past Google’s own testing. Certified Android devices must pass Google’s security checks before they ship. According to Google, the malicious code only loaded after a device’s first boot, so the boxes looked clean during testing. Charley Snyder, head of disruption operations at GTIG, told CyberScoop that “the XCPE operators constantly evolved its configurations to evade Google’s pre and post-launch detections.”
Built into the firmware
The backdoor lived in the device firmware and ran with Android system privileges. That made it extremely hard to remove. Even if a user found and deleted the package, it could reinstall itself from a protected partition after the next reboot. Researchers also found it could switch off Google Play Protect by altering the setting that verifies apps, and erase records of the user’s consent. Since August 2026, operators had been using droppers disguised as system packages that used a privilege-escalation exploit to write to the system partition, making removal even harder.
A platform for other criminals
XCPE worked in stages. The backdoor passed instructions to a loader, which then configured modules supplied by affiliates. Those modules could:
- Run hidden ad views to commit ad fraud.
- Turn the box into an exit point for a residential proxy network, so criminals’ internet traffic appears to come from your home connection.
- Steal account details and system logs.
- Install more malware, take live screenshots, inject keystrokes and open a remote shell.
That proxy feature is why this matters even if you never log into anything on your TV box. Your home IP address can be rented out and used to hide someone else’s activity.
Why it is trending
“Google Android botnet takedown” jumped into US trending searches after outlets including The Verge, The Register, CyberScoop and BleepingComputer covered the report. The story hits a nerve because cheap Android TV boxes are popular gifts and budget streaming options, and because this time the problem was not a shady app download. It came from a manufacturer that had been part of Google’s certified program.
It also follows a run of similar cases. Earlier operations known as BADBOX and BadBox 2.0 also abused low-cost Android devices; BadBox 2.0 involved more than 10 million uncertified devices. Reports note these figures are separate and should not be added to the XCPE total. Supply-chain and infrastructure attacks have been a big theme this autumn, from this case to the hijacked emergency alert apps in Ukraine and Russia.
Is my TV box affected? What to do
Google and the researchers did not publish a list of affected brands or model names, so there is no simple lookup. The good news for US readers is that infections were concentrated outside the US, though nearly 44,000 were found in the US in recent months. These steps, based on guidance in coverage of the takedown, are sensible for anyone with an Android-based streaming box:
- Check certification. Look up your box’s brand on Google’s Android TV partner list and confirm it is Play Protect certified. Unbranded or unknown boxes deserve extra suspicion.
- Keep Play Protect switched on. XCPE could turn it off quietly, so if you find it disabled and you did not do it, treat that as a red flag.
- Stick to trusted app stores and avoid sideloading apps from random websites.
- Avoid “earn money from your bandwidth” apps, which can turn your connection into a proxy.
- Buy from reputable makers and retailers, especially with holiday shopping and Black Friday deals coming up.
- If in doubt, unplug it. Because firmware-level malware can survive app removal and resets, replacing a suspicious no-name box with a known brand is often the safest fix.
What happens next
Google warned that the takedown “seriously impacted over a dozen malicious actors” but that the wider market for backdoors, ad fraud and residential proxies remains resilient and works like an interconnected supply chain. Expect the operators and affiliates to try to rebuild on other hardware. On Google’s side, the changes to firmware checks and device-maker reviews are meant to close the testing gap XCPE exploited; Google has not shared the specifics, to avoid helping attackers work around them.
Videostrong had not publicly responded in the coverage we reviewed.
Frequently asked questions
What is the XCPE botnet?
XCPE is a network of more than 1.3 million infected devices, mostly Android TV set-top boxes, controlled through a backdoor that Google says was built into the firmware by the maker, Videostrong Technology.
What did Google do?
Google took legal action against the botnet’s control servers and domains, disrupted infrastructure for more than a dozen malware families, banned Videostrong and its future subsidiaries from certified Android, and tightened its device-certification checks.
Which TV box brands are affected?
Google has not published a list of brands or models. The only company it named is Videostrong. Check that your box is Play Protect certified and comes from a reputable brand.
Can I remove XCPE by uninstalling an app or resetting the box?
Probably not. The backdoor ran with system privileges and could reinstall itself from a protected partition after a reboot. Replacing a suspicious device is often the safest option.
Why would criminals want a TV box?
Infected boxes can generate fake ad views for profit, route criminals’ traffic through your home internet connection, steal account details and install more malware.
Sources: Google Threat Intelligence Group, CyberScoop, Help Net Security, Cybersecurity News, BleepingComputer, The Verge, The Register, Tom’s Guide.
