Google dismantles XCPE botnet built into 1.3 million set-top boxes

Google said on Monday, November 2, that a manufacturing partner built a backdoor into about 1.3 million set-top boxes and ran them as a botnet for profit. Google and industry partners have dismantled the backdoor, called XCPE, and Google has cut ties with the maker, Shenzhen-based Videostrong Technology Co. ¹²

A botnet is a network of hijacked devices that does work for someone else without the owner knowing. Here, the devices were used for ad fraud, data theft and routing unauthorized network traffic. ¹ Google says it has high confidence the backdoor was intentionally developed, deployed and operated for financial gain. ² That is Google’s own assessment, and Videostrong’s side does not appear in the material we reviewed.

Most affected products were Android TV set-top boxes, but the malware also turned up in telehealth devices, karaoke machines and digital signage. ¹ It was found built into many models and brands over several years. ²

How the scheme worked: the main component runs with system-level privileges and, if a user removes it, reinstalls itself from a protected partition at reboot. ² It contacted a control server to receive commands, which could include silently installing apps, disabling Google Play Protect, running shell commands, capturing screenshots and collecting account and device information. ³ Videostrong also sold access to criminal affiliates, whose modules handled ad fraud and enrolled devices in residential proxy networks, which route strangers’ internet traffic through your connection. ²³

Google says it also disrupted control domains used by more than a dozen affiliate malware families, which it estimates cuts access to at least 10 million additional compromised devices. Those devices were infected through other channels as well, and not all are Android. ²³

Google banned Videostrong and any future affiliates from making certified Android devices with preloaded Google apps, or supplying software to certified vendors. ² It says Videostrong used obfuscation to load the malicious code after a device’s first boot, exploiting a gap in its compatibility tests, and that it has changed its review process. ¹² It worked with Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI. ²

Seen it before: a certification process that checks the device on day one and not on day two.

If you own an inexpensive no-name Android streaming box, check the manufacturer’s site and Google’s report for guidance. A similar campaign reported by researchers in March 2025 centered on generic, unbranded streaming boxes, so the brand on the case is a reasonable first question. ⁴ Treat any device that behaves oddly as suspect, and keep it off networks that carry sensitive data until its status is clear.

Our read: The unusual part is the source of the problem: a certified partner, not a rogue app. Google’s own account says the tests missed it, and a patched review process only helps future devices. The 1.3 million figure covers boxes tied to this one backdoor; the larger 10 million estimate suggests the affiliates’ infrastructure is the bigger story. Google itself says lasting disruption will take continued work against that supply chain, so watch for further takedowns and for any list of affected models. ²

Footnotes

1. The Verge, “One of Google’s Android partners turned 1.3 million set-top boxes into a botnet”. Retrieved November 2, 2026. ↩ ↩² ↩³ ↩⁴

2. Google Cloud Blog, “Shutting the Door on the XCPE Botnet”. Retrieved November 2, 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹ ↩¹⁰

3. BleepingComputer, “Google disrupts million-device XCPE Android malware botnet, bans TV box maker”. Retrieved November 2, 2026. ↩ ↩² ↩³

4. WIRED, “1 Million Third-Party Android Devices Have a Secret Backdoor for Scammers”. Retrieved November 2, 2026. ↩