🔍 Read the full analysis: How Factory-Linked Malware Turned TV Boxes Into A Botnet on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Google and industry partners say they disrupted the XCPE botnet in late October, after identifying more than 1.3 million infected set-top boxes. Google attributes the firmware backdoor to manufacturer Videostrong; the company did not respond to media requests cited in the source. The disruption cut access to control servers, but Google says the backdoor can survive a reboot, so infected devices may remain compromised.
Google and industry partners disrupted the XCPE botnet in late October, a network the company says involved more than 1.3 million set-top boxes with a backdoor built into their firmware. Google attributes the operation to Shenzhen-based device maker Videostrong Technology Co., saying infected boxes were used for residential proxy traffic and ad fraud, among other activity.
Google’s Threat Intelligence Group (GTIG) published its account on November 2, saying it worked with Japan’s National Police Agency and security companies to disable domains and servers used to control the botnet and deliver malware. The company also said it took legal action against control servers for more than a dozen malware families installed on the boxes as add-ons. The source material does not provide a court name or case number.
TrendAI counted 1,472,554 infected devices between June 3 and October 1, 2026, and described that figure as a lower bound. Google separately described the botnet as involving more than 1.3 million set-top boxes. The counts refer to identified devices over that stated period, not a confirmed total of all devices ever infected.
According to GTIG, the boxes’ main uses included routing other people’s internet traffic through owners’ home connections and generating fraudulent ad activity. Google also reported capabilities to take screenshots, inject keystrokes, collect account and device information, open remote shells, and install apps without the user’s knowledge. Those capabilities are described by Google; the source does not establish that every function was used on every infected device.
Infographic 01 · XCPE in numbers
A botnet that shipped from the factory
Google says the device maker Videostrong built the backdoor into its own firmware and sold access. That is Google’s assessment; Videostrong did not respond to the press.
set-top boxes in the XCPE botnet, the joint figure of Google and its partners. Taken down in late October 2026.
- 1,472,554 infected devices in TrendAI’s own telemetry, 3 Jun to 1 Oct 2026, a lower bound.
- Partner counts differ by snapshot and view, so the joint figure is “more than 1.3 million”.
- 10M+ more devices lost their malware’s control servers: Google’s estimate, not a count.
How one box earns money for criminals
- Built inA system app sits in the firmware and reinstalls itself after a reboot
- Phones homeOn start it fetches settings and keeps a line open to a control server
- Sold onAccess is sold to partners, who push their own modules
- Cashed inResidential proxy, hidden ad views, more backdoors
Your home internet address is the product. Strangers rent it, and their traffic looks as if it came from your living room.
Sources: Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026. Simplified for readers; no indicators or technical details reproduced.
Powered by Thorsten Meyer AI
Why Infected TV Boxes Matter
The case shows how a consumer device can become part of a criminal network before an owner first uses it. If the backdoor is installed in factory firmware, avoiding suspicious links or apps may not protect a buyer. A box can appear to work normally while its internet connection is used by others, potentially making harmful traffic appear to come from a household or office.
The reported functions also create risks beyond bandwidth and ad fraud. Remote commands, screen capture, and local-network scanning could expose information or provide a route to other devices, although the source does not quantify resulting harm or confirm that every capability was exercised. For businesses, the episode is a reminder that connected devices on home or office networks can affect security even when they are not conventional computers.
Google says it banned Videostrong from building certified Android devices and tightened firmware-integrity checks. Those measures address future certification and control infrastructure; they do not, by themselves, remove a persistent backdoor from boxes already in use.
Popular right now
Hisense 65-inch U6 Pro Mini-LED 4K UHD Smart Fire TV
TCL 65-Inch T7 Series 4K QLED Smart Google TV, 144Hz (65T7)
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
As an affiliate, we earn on qualifying purchases.
How the Firmware Backdoor Worked
GTIG says the malware included a small system app called x.cpe, or com.oemservice in some builds. It had system-level privileges and could reinstall itself from a protected partition after a reboot if removed. On startup, it contacted a control server, received settings, and maintained a connection that allowed operators to send commands. Google says the software could disable Play Protect checks before installing additional apps.
Google reported that the system had several layers: a component that contacted the server, a separate loader, and modules supplied by affiliates. It said the architecture had been in place since at least late 2024. In August 2026, new droppers disguised as Android system apps began replacing the loader, which GTIG interpreted as an effort to stay hidden.
Some affected devices were Google-certified, according to the report. Google said Videostrong used obfuscation and loaded malicious code after a device’s first boot to evade its checks. The source says the company changed its review process in response. It also reports Google’s estimate that action against add-on malware servers could cut off access to at least 10 million additional compromised devices. That is an estimate, not a device count, and the source says those devices may include non-Android products.
“The backdoor and the botnet “were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group
What the Disruption Did Not Remove
Google’s action disabled control infrastructure, but the source says the firmware backdoor remains on infected boxes and can reinstall itself after a reboot. It is not clear how many devices still contain it, how many remain online, or whether other control servers have replaced those taken down. Removing an app through ordinary settings may not remove the firmware component.
Videostrong did not respond to requests for comment from The Record and heise, according to the source material. The account does not include a public court filing or case record. Google’s attribution and description of the manufacturer’s actions therefore remain claims made by the company in the material provided; no response from Videostrong is included.
The published figures also have different scopes: Google’s “more than 1.3 million” describes XCPE set-top boxes, while TrendAI’s specific count covers June 3 through October 1 and is described as a lower bound. Google’s estimate of at least 10 million additional compromised devices concerns malware spread through other channels and should not be treated as the confirmed size of XCPE.
Checks for Owners and Network Operators
Google says it has banned Videostrong and its future subsidiaries or affiliates from making certified Android devices or supplying software to certified vendors, and has strengthened firmware checks for certified Android TV devices. The source does not give a timetable for those changes or describe any individual remediation tool for boxes already sold.
Owners can check whether a device is Play Protect certified, but certification alone should not be treated as proof that a particular box is safe. The source advises caution with no-name or “unlocked” devices and recommends unplugging or replacing a box considered suspicious. Keeping TV boxes on a separate guest network can limit their access to other devices. Businesses should treat connected home and office equipment as part of their security exposure and avoid relying on an IP address’s reputation alone.
Google’s account leaves open how many devices will need replacement or other remediation and whether further enforcement or technical updates will follow. Owners should watch for guidance from Google, device vendors, and relevant security authorities.
Key Questions
What was the XCPE botnet?
XCPE was a network of set-top boxes that Google says contained a firmware backdoor. The infected devices could connect to control servers and receive commands, including instructions to install additional malware.
How many TV boxes were affected?
Google described the network as involving more than 1.3 million set-top boxes. TrendAI counted 1,472,554 infected devices from June 3 to October 1, 2026, and said its figure was a lower bound.
Does taking down the servers remove the malware?
Not necessarily. The source says the takedown cut off the botnet’s control infrastructure, but the backdoor remains in device firmware and can reinstall itself after a reboot. The report does not give a complete removal process for affected devices.
What should owners of a suspicious TV box do?
The source recommends treating a suspicious device as untrusted: unplug or replace it, and keep TV boxes on a separate guest network. Owners can also check Play Protect certification, while recognizing that certification does not establish whether a specific device is currently compromised.
Has Videostrong responded to the allegations?
According to the source material, Videostrong did not respond to comment requests from The Record and heise. The material also does not provide a public court filing or case number.
Source: ThorstenMeyerAI.com
