What did Google announce about the XCPE botnet?
Google's Threat Intelligence Group published its account of the XCPE botnet on 2 November 2026. The company said the backdoor had been dismantled the previous week. It worked with Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI. More than 1.3 million Android set-top boxes had been enrolled in the network.
Google attributed the operation with high confidence to Videostrong Technology Co. The company is a Shenzhen-based original equipment and design manufacturer that builds Android TV boxes and projectors. Google says Videostrong embedded the backdoor in device firmware. It then sold access to criminal affiliates, who loaded their own malware modules onto the boxes.
The response mixed legal action with commercial penalties. Google took legal action to take down the domains and servers that controlled the botnet. It also targeted command infrastructure used by more than a dozen malware families loaded through the backdoor. Google banned Videostrong, and any future subsidiaries or affiliates, from building or selling certified Android devices or supplying software to certified vendors.
Google also tightened firmware integrity checks for certified Android TV devices. It changed its manufacturer review process to close the gap that Videostrong exploited. The company did not name the court or jurisdiction behind its legal action. It also did not say how many of the infected boxes remain in use or online.
The disclosure came with a warning about scale. Google said the takedown would significantly affect the criminal operation, but not end it. It described backdoor operators, ad-fraud rings and proxy providers as interlinked businesses. The post also links the case to Google's earlier legal action against BadBox 2.0, another botnet built on cheap Android hardware.
The report is also a rare public accounting of a supply-chain failure. Google names a business partner, explains how that partner evaded review and sets out penalties. Most botnet write-ups concentrate on the malware itself. This one treats the manufacturer as the central actor, with malware as its product line.
How did the XCPE backdoor get onto certified devices?
Android certification is meant to signal that a device has passed compatibility and security checks. Google says Videostrong found a way around that promise. The manufacturer used obfuscation techniques to exploit a gap in Google's testing. It then loaded malicious code after the device's first boot, once those checks had finished.
Google said the software appeared in many device models and brands over several years. It described the campaign as deliberate rather than accidental. The post says the operation had dedicated infrastructure and constantly changing configurations. Google rejected the idea that a rogue employee or a development mistake could explain it.
The implant was built to survive removal. It ran at the android.uid.system privilege level and sat in the firmware partition. If a user deleted it, the device reinstalled it from the /oem/ partition on the next reboot. Some builds shipped the package under the name com.oemservice instead of x.cpe.
Since at least late 2024, the malware had evolved into a three-stage system. A primary backdoor handled command traffic. A loader called com.abc.nexus executed modules and used native tools to avoid sandbox detection. Google says that loader has since been replaced by narrower droppers.
The evolution continued after discovery. From August 2026, Google observed new dropper packages arriving over the botnet's command channel. They were disguised as Android system applications, with names such as com.android.system.ntp and com.android.sso.auth.handler. That suggests the operators kept adapting while Google's review was under way.
Google's post is unusually direct about responsibility. It says manufacturers must pass a comprehensive suite of compatibility and security tests. It then acknowledges that Videostrong exploited a gap in those tests. The fix, according to Google, includes better checks on firmware integrity rather than app scanning alone.
What can an infected Android TV box actually do?
The device is fully remote-controlled, not merely ad-infected. The malware first contacts an HTTP server for configuration, geolocation and network details. It then opens a persistent MQTT connection to receive instructions. Google describes that channel as the botnet's main control path.
The commands include silent app installation, arbitrary shell commands, screen captures and network reconnaissance. Help Net Security, summarising the published research, also reported keystroke injection. A single box could therefore be used to watch a room, install more software or probe the local network.
The implant also disables Google Play Protect. Google's analysis says it changes the system setting package_verifier_user_consent to -1. That turns off app verification, removing the main on-device check that might flag the modules. Play Protect is the layer most Android users rely on for day-to-day safety.
Monetisation was modular. Google lists residential proxy modules called Linkfog, AppSalt and NetNut. Ad-fraud modules included CBOXTV and HiddenView. Other modules, Moyu and Spirit, loaded further backdoors. Google says some devices ran as many as three residential proxy SDKs at the same time.
The control protocol is more sophisticated than a simple beacon. Google says the first request carries hardware identifiers, including serial number, MAC address, model and firmware version, encrypted with AES. The server returns broker details and a topic structure keyed to each device. A second endpoint supplies geolocation and network-address-translation data.
- •Silent installation of apps delivered from remote servers
- •Shell access running with system-level privileges
- •Screen capture and remote monitoring of the device
- •Google Play Protect verification switched off
How many devices are affected, and where are they?
The 1.3 million figure covers set-top boxes linked to the XCPE backdoor. The Register reported that they were spread across more than 200 countries. That number describes the network's reach, not the count of active victims on any given day.
Most infected devices were Android TV boxes. Google also found the malware on telehealth devices, karaoke machines and digital signage. Those categories widen the risk. A clinic, a bar or a shop window display can sit on the same network as laptops and payment systems.
The 10 million figure is different and often misread. It is Google's assessment of devices that may lose malware access because affiliate command domains were taken down. Those devices were compromised through other distribution channels, not through XCPE itself. Google called it an assessment rather than a device count.
9to5Google reported that a list of potentially affected models compiled by Synthient focuses on the Mecool brand. Mecool has sold Android TV and Google TV boxes. The reporting did not establish that every Mecool device was infected. Owners should check model details instead of assuming the worst.
This is not the first botnet of its kind. The Register noted that XCPE sits in the same ecosystem as BadBox 2.0. That operation infected more than 10 million TV boxes and other devices before Google, Human Security and TrendAI disrupted it in March 2025.
Geography is harder to pin down than the headline count. Google published a figure showing the global distribution of x.cpe infections. It did not give a country-by-country breakdown in the post. The Register's figure of more than 200 countries shows how widely the boxes were sold, not where the largest clusters sit.
The brand picture is similarly broad. Google says the malware was built into many different device models and brands over multiple years. That makes a simple brand boycott hard to apply. The practical test is the model number and the seller, not the logo on the box.
What should owners of a Videostrong or Mecool box do?
For an owner, the uncomfortable finding is that ordinary clean-up will not work. The malware restores itself from a protected partition after a reboot. It may also have switched off Play Protect, so a security scan could come back clean. Uninstalling a visible app is not enough.
The takedown should stop most remote commands. Google took down the domains and servers that issued instructions. But a device that still runs the implant remains compromised even when it is quiet. The backdoor is dormant, not removed.
The safest response is to stop using an affected box and replace it with a device from a mainstream vendor. In the meantime, owners can move it to a guest network, away from computers, phones and storage. A router's device list will show whether an unfamiliar set-top box is online.
A factory reset is not a guaranteed fix. The malicious stub ships in the system and oem partitions, which a standard user data reset is not designed to rewrite. Some sellers may publish clean firmware. Google's public post, however, does not offer per-model repair instructions.
Buyers should also treat certification as a starting point rather than a guarantee. Certification depends on tests conducted at a particular time. Videostrong's code arrived after first boot, which is precisely where a one-off inspection can miss it.
- •Identify the exact brand and model before connecting the box again
- •Keep it on an isolated guest network if it must stay online
- •Replace it if the model appears on a published list
- •Check the router for devices you do not recognise
Why does a TV-box botnet matter to the wider internet?
The economics explain why a television box became a target. Botnets are not only rented for attacks. They are rented as infrastructure, including proxy capacity that other criminals use to look like ordinary broadband customers.
That market rewards scale and patience. A box that costs little, stays plugged in for years and receives infrequent updates is ideal inventory. The owner notices a slower connection, if anything, not a compromise.
The affiliate structure spreads the risk. Videostrong supplied the backdoor. Other groups supplied ad-fraud and proxy modules. Google says those affiliates distribute modules through other channels too, so one takedown does not end their business.
The victims are not only households. Small businesses use Android boxes for signage, waiting rooms and staff training. Telehealth devices may hold personal data. A compromised box on those networks can expose more than a streaming account.
There is also a trust cost. Consumers cannot inspect firmware, so they rely on brand names and certification marks. When a certified manufacturer sells access to its own customers, that signal weakens for every budget device. Google called the conduct "an unacceptable breach of trust".
The scale matters because these devices rarely sit alone. A set-top box shares a router with phones, laptops and sometimes a home office. Once an operator can run shell commands inside the home network, the box becomes a foothold rather than a single faulty appliance.
The legal risk can travel too. Malicious traffic exits through the subscriber's public IP address. Abuse complaints and blocklists can therefore land with a household that took no part in the activity, even though the device, not the person, did the work.
For the security industry, the case is a reminder that the weakest link is often the factory, not the router. Buyers can patch software they can see. They cannot rewrite firmware they cannot inspect. Vendors control that layer, and certification is one of the few levers available to buyers.
What happens next for Android certification and the proxy economy?
Google says it has changed how it reviews manufacturers and verifies firmware. It has not described those changes in detail. Charley Snyder, who leads disruption operations at Google Threat Intelligence, told CyberScoop that specifics could help attackers evade the new checks.
That argument is familiar in security, and so is the criticism. Defenders gain time, but buyers and researchers cannot independently judge whether the gap has closed. The next test will come from devices already in warehouses and homes.
Google's own framing suggests the problem will persist. The company described backdoor operators, ad-fraud rings and proxy providers as an interconnected supply chain. It said point-in-time disruptions help, but lasting disruption requires continued pressure on the infrastructure.
The ban has limits. It stops Videostrong from certifying new devices and from supplying software to other certified vendors. It does not recall the boxes already sold, and it does not reach units shipped without Google apps. Those devices can stay in service for years.
Certification is not a continuous public audit. Google tests devices before release and can withdraw approval when a vendor breaks the rules. Buyers see a label, not the test results or a live security score. That gap matters when a manufacturer is willing to cheat after the checks end.
Several questions remain open. Google's post does not list every affected model. It has not said whether other manufacturers are under review. No arrests were announced in its post, and the jurisdiction behind the legal action was not disclosed. Videostrong did not immediately respond to The Register's questions.
Watch for three signals. First, whether retailers stop selling affected boxes. Second, whether Google expands Play Protect enforcement against the remaining modules. Third, whether regulators treat preinstalled malware as a product-safety issue rather than a fraud story. Each would change the incentives that made XCPE profitable.