Google dismantles XCPE botnet hidden in 1.3 million Android TV boxes
Google says Chinese device maker Videostrong built a backdoor into the firmware of more than 1.3 million TV boxes. What happened and how to protect yourself.
The essentials: Google and several security firms have dismantled XCPE, a backdoor that had enrolled more than 1.3 million set-top boxes into a botnet, Google said on November 2, 2026. Google assesses “with high confidence” that the malware was built and run for profit by Videostrong Technology, an Android device maker, which preloaded it in the firmware of its boxes. The infected devices were used for advertising fraud and rented out as proxies to route other people’s internet traffic.
What is XCPE?
XCPE is malicious code hidden in the system software of the devices, Google’s Threat Intelligence Group explains. Because it is preloaded in the firmware, users cannot remove it: if it is uninstalled, it reinstalls itself at the next reboot. It also switches off Google Play Protect’s app verification.
Google says Videostrong used obfuscation “to exploit a gap in our tests and load malicious code after the device’s first boot”. The company is “a hardware manufacturer based in Shenzhen, China” that makes TV boxes and projectors, according to The Register. Videostrong did not immediately respond to the publication’s questions.
Most infected devices are Android TV set-top boxes, but Google also found the backdoor in telehealth devices, karaoke machines and digital signage. “A device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust,” Google wrote. It did not name the brands or models involved.
What were the infected boxes used for?
Once installed, the backdoor downloaded extra modules sent from servers controlled by its operators. According to Google, they were used to:
| Use | What it means for the owner |
|---|---|
| Advertising fraud | The box loads and “views” ads in the background to generate fake revenue |
| Residential proxy networks | The owner’s internet connection is resold so that strangers can route traffic through it |
| Installing other malware | Over a dozen malware families were loaded through the backdoor |
| Remote control | Operators could capture the screen, inject keystrokes and run commands on the device |
Some of these modules had previously been linked to BadBox, an earlier botnet of compromised Android devices. The Register says XCPE belongs to the same ecosystem as BadBox 2.0, which infected more than 10 million TV boxes before it was disrupted in March 2025.
Who took it down, and how?
Google worked with Japan’s National Police Agency and the companies Lumen, HUMAN Security, Plume, Synthient and TrendAI. None of the three sources mentions arrests. Google lists four measures:
- legal action to take down the domains and servers used to control the botnet;
- legal action against the command servers of the malware families installed through it;
- a ban on Videostrong and any future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors;
- tighter checks on the integrity of firmware on certified Android TV devices.
Google adds that taking down those command domains “will sever access to at least 10 million additional compromised devices”. The scale is hard to pin down: TrendAI counted more than 3.8 million distinct internet addresses linked to the botnet between June 3 and October 1, The Register reports, and an address is not the same as a device.
What should owners of cheap TV boxes do?
9to5Google believes the takedown should leave affected boxes safe to use, but suggests owners may still want to consider alternatives. Google, for its part, warns that “this is not the end of our work” and gives general advice:
- buy connected devices, such as set-top boxes, only from reputable manufacturers, and check the list of Android TV partners on android.com/certified/partners;
- be “extremely wary” of apps offering payment for “unused bandwidth” or “sharing your internet”;
- install apps only from trusted stores, review the permissions of third-party VPNs and proxies, and make sure Google Play Protect is switched on.
Other recent cases show how ordinary devices become entry points for attackers, from hacked emergency alert apps to a flaw in the Linux kernel.
