Google Takes Down XCPE Botnet Built Into 1.3 Million Android TV Boxes, Bans Maker Videostrong
Google says it has dismantled a botnet of more than 1.3 million Android TV set-top boxes, and the twist is who built it. According to a Google Threat Intelligence Group report published Monday, the backdoor behind the XCPE botnet was planted by the devices’ own manufacturer, Videostrong Technology Co., a China-based company that makes Android hardware for other brands.
Google says it assesses “with high confidence” that the backdoor and botnet “were intentionally developed, deployed, and operated for financial gain” by Videostrong, and that it was not the work of a rogue insider or a development oversight.
How XCPE worked
The backdoor shipped inside the boxes’ firmware and used obfuscation to slip past pre-release security testing, then pulled down additional software after owners first switched the hardware on. Google says Videostrong sold access to criminal affiliates and loaded their malware modules onto infected devices. Those modules ran ad fraud, quietly enrolled boxes in residential proxy networks that route strangers’ traffic through owners’ home connections, and installed more malware.
Google found the code in many device models and brands over multiple years. Most infected devices were TV boxes, but it also turned up on telehealth devices, karaoke machines and digital signage. Security firm TrendAI, which supplied intelligence for the takedown, says its telemetry counted 1,472,554 infected devices across 206 models in more than 170 countries between June and October 2026, and more than 3.8 million distinct home and mobile IP addresses used as proxy exits over four months.
What Google did
Google says it took legal action to seize the domains and servers Videostrong used to control the botnet, plus command-and-control domains for more than a dozen malware families loaded through the backdoor. Because those affiliates also spread their modules by other means, Google estimates the action severs access to at least 10 million additional compromised devices. Digital Trends reports Japan’s National Police Agency was among the partners.
Google has also cut ties with Videostrong, banning it and any future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors, and says it is tightening firmware integrity checks for certified Android TV hardware.
What owners should do
Taking down the servers does not clean the boxes. BleepingComputer notes the malware reinstalls itself from a protected system partition if removed, so a factory reset will not fix it; clean firmware or disconnecting the device is the only real remedy. TrendAI says the implant runs as a system app signed with the manufacturer’s key, so owners cannot remove it themselves.
Google’s advice is to buy from reputable brands and keep Google Play Protect on. If you own a Videostrong-made box, the safest move is to unplug it from the internet and replace it with certified hardware.
Sources: Google Threat Intelligence Group, TrendAI Research, BleepingComputer, Digital Trends