The box arrived ready to watch television. It also arrived, according to Google, ready to work for criminals. In a report published on November 2, Google’s Threat Intelligence Group said it and a group of partners had dismantled a botnet called XCPE that enrolled more than 1.3 million set-top boxes — the overwhelming majority of them Android TV boxes — and that the backdoor behind it was not planted by outside hackers after the devices were sold. Google says the manufacturer built it in.
The company it names is Videostrong Technology Co., a Shenzhen-based firm that makes Android devices both under its own brands and for other labels, acting as what the industry calls an original equipment manufacturer and original design manufacturer. Google says it assesses “with high confidence” that Videostrong intentionally developed, deployed and operated the backdoor and the botnet for financial gain: selling access to criminal affiliates and loading those affiliates’ malware modules onto infected devices. Videostrong had not publicly responded to the claims at the time the reports appeared.
Hidden in the firmware, out of the owner’s reach
The backdoor, tracked as x.cpe and as com.oemservice in some builds, was preloaded into the device’s firmware and ran with Android system privileges. That placement is what makes XCPE different from an app a user might install by mistake. Firmware sits below the apps, in the part of the device that survives a factory reset in spirit if not in every detail, and Google’s reporting says the component reinstalled itself from a protected partition when removed. In practice, an owner could not simply uninstall it.
Google says the operation had been running since at least late 2024, evolving from simple droppers into a modular, three-stage design built to last. The main criminal use was renting the boxes out as infrastructure: routing other people’s internet traffic through victims’ home connections as residential proxies, alongside ad fraud and the distribution of further malware. Researchers who worked on the takedown counted the scale independently — TrendAI, one of the partners, recorded 1,472,554 infected devices across 206 models in more than 170 countries between June and October 2026, with the largest concentrations in Malaysia, Brazil, Iraq, Mexico and Taiwan. Most of the infected hardware was TV boxes, but the backdoor also turned up on Android-based telehealth equipment, karaoke machines and digital signs.
What Google actually took down
The disruption, carried out in late October with Japan’s National Police Agency and security firms Lumen, HUMAN Security, Plume, Synthient and TrendAI, hit the network’s control layer rather than the devices in people’s homes. Google says it took legal action against the domains and servers Videostrong used to control the botnet and install modules, and separately against the command-and-control domains of more than a dozen malware families that rode in through the backdoor. Because those affiliate operations had spread beyond XCPE itself, Google assesses that cutting their control domains will sever criminal access to at least 10 million additional compromised devices — a Google estimate, not an independent count.
Google also cut ties with Videostrong outright, banning the company and any future subsidiaries or affiliates from building and selling certified Android devices, or supplying software to other certified vendors. The ban matters because of a detail that should worry anyone who buys on trust: these were not grey-market boxes that skipped Google’s checks. They were certified devices, which are supposed to pass compatibility and security tests before they can ship with Google apps preloaded. The backdoor got through anyway.
Why this one is different
Supply-chain infections are not new. Google’s own action against the BadBox 2.0 network in 2025 involved more than 10 million uncertified devices, and state-linked tooling seizures continue to surface — the FBI recently seized hacking tools linked to China’s Flax Typhoon operation. XCPE stands apart because the accused party is the manufacturer itself, and a certified one at that. The usual advice — buy from reputable brands, avoid unknown boxes, keep software updated — assumes the danger comes from somewhere else. Here, the danger came with the product, in the box, from the factory.
That leaves owners in an awkward position. Google has not published a list of affected brands or models, and there is no official lookup that tells a buyer whether a particular box carries the code. The control servers are down, which breaks the botnet’s ability to take orders, but reporting on the takedown is clear that the backdoor itself may still sit in the firmware of boxes already sold. For anyone with a cheap, unfamiliar Android TV box — especially one bought online under a brand they cannot trace — the practical options are blunt: disconnect it, check with the seller or brand for a firmware update, and replace it with a certified device from a known maker if anything about it looks off. The episode is also a reminder that the cheapest box in the search results carries a cost that does not appear on the price tag: in this case, other people’s traffic running through your living room, on your internet connection, without your knowledge. It is not the first time everyday connected devices have been turned against their owners — hackers recently turned French supermarket freezers up to 50°C overnight.
The takedown also shows how this kind of enforcement now works. It was not one company acting alone but a coalition of a platform owner, police and rival security firms pooling evidence — Plume spotted the anomalous traffic pattern, Synthient traced it to Videostrong, TrendAI counted the fleet — until legal action could cut the network’s head off. The boxes remain. The network, for now, does not.
Source: Google Threat Intelligence Group, “Shutting the Door on the XCPE Botnet” (November 2, 2026).
