What is the XCPE botnet and what did Google shut down?
Google's Threat Intelligence Group says it has dismantled XCPE. The backdoor and botnet ran on more than 1.3 million Android TV set-top boxes. Google announced the dismantling on 2 November 2026. Its Threat Intelligence Group published the technical account a day later, describing an operation that took place the previous week.
The name comes from x.cpe, a package that shipped inside device firmware. Google says this was not a hobbyist experiment. The software appeared in many models and brands over several years, with dedicated infrastructure and regular updates to evade detection.
Google attributes the campaign to Videostrong Technology Co., a Shenzhen-based Android original equipment manufacturer and original design manufacturer. Ars Technica reports that the affected boxes were Google-certified, which means they passed the checks required to carry Google apps and branding.
The response has three parts. Google took legal action against the domains and servers used to control the botnet and install modules. It also targeted command-and-control domains tied to more than a dozen malware families loaded through the backdoor. Finally, it banned Videostrong, and any future subsidiaries or affiliates, from building certified Android devices or supplying software to other certified vendors.
- •Legal action against the botnet's control domains and staging servers.
- •Takedowns against command-and-control domains for affiliated malware modules.
- •A ban on Videostrong making certified Android devices or supplying certified vendors.
- •Changes to how Google verifies firmware integrity on certified Android TV hardware.
How did the malware get past Google's certification tests?
Devices need to pass compatibility and security testing before they can ship with Google apps. That process is meant to catch exactly this kind of tampering. Google says Videostrong used obfuscation to exploit a gap in its tests, then loaded malicious code after the first boot.
The infection chain starts with a stub package preloaded in the system partition. It runs at android.uid.system, the highest privilege level available to an Android app. On boot, it looks in the device's oem directory and installs the full package into the data partition.
Google says the backdoor has evolved since at least late 2024. Early versions were simple droppers that carried their payloads. Later builds split the work between x.cpe, which handles command traffic, and a separate loader called com.abc.nexus, which executes the modules.
That split may have been a response to earlier Google enforcement against the BadBox botnet, according to the report. The company says the change let the core package stay quieter while the loader absorbed the suspicious behaviour.
The loader starts through a boot receiver and sets up a service that listens for instructions. It then unpacks native libraries and downloads extra payloads. Some versions carried at least four modules, while others carried as few as one.
Many builds also included a hardening library that filters system calls. Google says it blocks tools that try to pause or terminate the malware's threads and prevents sandbox inspection. That is a deliberate anti-analysis step, not a packaging accident.
The architecture kept changing. From August 2026, operators pushed new droppers through their message channel. Some disguised themselves as system components, used Android's debugging service to gain root and copied themselves into the privileged app directory. Google says it has since tightened its review process.
What can the XCPE backdoor do on an infected device?
The backdoor's first job is to stay resident. Google says users cannot remove x.cpe. If the package is deleted from the data partition, a boot receiver reinstalls it from the oem partition after a restart.
Its second job is to keep talking to its operators. The malware fetches configuration over HTTP. It then opens a persistent connection to a message broker using MQTT, a lightweight protocol designed for unreliable networks. Commands arrive on per-device topics built from the model and chip identifier.
Before that connection opens, the device sends an encrypted JSON payload with its serial number, MAC address, model and firmware version. The server replies with broker credentials, topic names and flags that switch individual ad or proxy modules on or off.
The same response can supply a geolocation lookup and a STUN server. Those help the operator learn the public IP address and port mapping, which matters when the box sits behind a home router.
Google says it also disables Google Play Protect by writing a value that turns off app verification. That removes the main system warning a user would normally see when a new app is installed silently.
The documented command set is broad. Operators could install apps without consent, run shell commands and scripts, capture screenshots, inject keystrokes and map the local network. Google says it observed live screenshots, account and device data theft, and reverse shells on victim devices.
The money came from modules supplied by criminal affiliates. Some turned boxes into residential proxy exit nodes. Others performed ad fraud or loaded further backdoors. Google says it found devices running as many as three proxy software kits at once.
Two examples show how different the modules are. Linkfog's component unpacks a Go binary and connects through reverse tunnels, selling the box as a content-delivery and proxy node. A second module, Jaguar, is a native binary. It derives a ChaCha20 key to decode its configuration before opening an encrypted command channel. Google describes it as capable of relaying both TCP and UDP traffic.
- •Silent installation of remote APKs.
- •Arbitrary shell and script execution as the system user.
- •Screen capture and remote key injection.
- •Residential proxy, ad fraud and secondary backdoor modules.
- •Data exfiltration covering account details, installed packages and system logs.
How many devices are affected, and who is behind it?
Google puts the botnet at more than 1.3 million Android TV set-top boxes. It says the devices are spread globally, with clusters that may reflect where a brand sold best. Most were TV boxes, but the same code appeared on telehealth devices, karaoke machines and digital signage.
The company estimates the wider action cut access to at least 10 million more compromised devices. That figure covers systems reached by affiliate modules outside XCPE. Google says each affiliate has its own distribution channels, so disrupting one botnet does not remove the others.
Synthient founder Ben Brundage told Krebs on Security that the official count is low. "The scale of affected devices is likely way higher," he said. He called it probably the largest operation against backdoored TV boxes so far. Synthient tracks proxy networks and worked on the takedown.
The brand picture is more complicated than a single logo. Ars Technica reports that the compromised boxes were mostly sold under the MECOOL name. Krebs on Security cites a Synthient report on MECOOL boxes sold by Skyworth Technology. It says those boxes also bundled Videostrong's malware and proxy components.
Google rejects the idea that this was a rogue employee or a coding mistake. It says the campaign was built for financial gain, with a supply chain of affiliates paying for access to infected devices. Videostrong has not issued a public response cited in the coverage reviewed here.
These boxes rarely reach buyers through carrier stores. Krebs on Security notes that they spread through influencer videos and word of mouth. The pitch often promised hundreds of pay-TV channels for a one-time fee. Synthient observed a surge after a 2023 mention by Linus Tech Tips, a channel with nearly 17 million subscribers. The channel told Synthient it had updated the video to label the product a scam and removed affiliate links.
How does XCPE compare with earlier TV-box botnets?
XCPE is not the first criminal network built on cheap streaming hardware. Google's report says the shift in its architecture around late 2024 may have followed earlier enforcement linked to BadBox. The company does not publish a full history of that case in this report.
In January 2026, Synthient documented a different operation called Kimwolf. According to Krebs on Security, it infected millions of Android set-top boxes in a short period. It then used them for record-breaking distributed denial-of-service attacks. It spread through a weakness in residential proxy services and later fragmented after providers patched their networks.
A third case reached law enforcement. In July 2026, the FBI and partners seized hundreds of domains tied to NetNut, a proxy provider operated by Alarum Technologies. Krebs reports that the FBI said the company ran a separate botnet, Popa, that also enslaved TV boxes as proxy nodes.
The pattern is consistent. Cheap hardware, factory software, always-on connections and a resale market for bandwidth. Each takedown removes one operator, but the affiliates and their modules often survive the loss of a single distribution channel.
Are infected TV boxes fixed now, and what should owners do?
Taking down servers stops new commands from arriving. It does not erase code that shipped in firmware. Google's own description says the backdoor cannot be removed by the user and reinstalls itself after a reboot if deleted.
Google's published list of actions does not include a recall, a firmware cleaner or a consumer checker. That leaves owners of affected models in an awkward position. A factory reset restores user data, but it does not replace the preloaded system software that contains the stub.
Google has not published an official tool for checking a specific box. Krebs on Security notes that Synthient published a list of affected devices by model number. Owners who find a match should treat the device as compromised rather than assume the takedown cleaned it.
The practical options are limited. Replacing an affected box is the surest fix. Disconnecting it from the network stops it acting as a proxy node. Google says operators could read account information. Affected owners should also review passwords and active sessions for accounts used on or near the device.
Why do criminals want a TV box on your home network?
A residential proxy service sells access to ordinary internet connections. Customers route traffic through someone else's IP address to look like a local user. That is useful for price comparison and region-locked content, and it is also abused for fraud.
Krebs on Security notes that residential proxies drive much malicious traffic. That includes account takeover, advertising fraud and mass scraping for AI projects. A TV box is a good host. It is always on, rarely inspected and usually sits behind the same router as phones and laptops.
The report names proxy and ad-fraud modules including Linkfog, AppSalt, NetNut, CBOXTV and HiddenView. AppSalt is also known as Honeygain and is owned by Oxylabs. Krebs reports that Oxylabs relaunched as Source in October 2026 after a $130 million funding round. NetNut's operator, Alarum, was linked to a separate TV-box botnet called Popa that the FBI moved against in July 2026.
Google acknowledges that the market will adapt. "The underlying illicit market is resilient," the company said, according to SecurityWeek. It describes backdoor operators, ad-fraud rings and proxy providers as an interconnected supply chain that swaps loaders when one part is disrupted.
What to watch next after the XCPE takedown
The first question is whether other manufacturers used similar tricks. Google says it found the software across many models and brands, but it has publicly blamed only Videostrong. Audits of certified hardware would show whether the gap was unique or widespread.
The second is remediation. A ban prevents future devices, and domain seizures disrupt current operations. Neither helps someone who already owns an infected box. Watch for a recall, a trade-in scheme or a firmware update that removes the stub.
The third is the affiliate network. Google says its action affected more than a dozen malicious actors, but those groups have other distribution paths. New loaders and proxy brands are likely to appear, and Synthient's device list may grow.
Independent technical write-ups from Plume, Synthient and TrendAI accompany the Google report. They add analysis of the modules and, in Synthient's case, a list of affected models. Those indicators have a short shelf life because operators rotate infrastructure.
The broader lesson concerns trust signals. A Google-certified badge told buyers that a device met compatibility and security standards. This case shows that certification is a checkpoint, not a guarantee, especially when firmware can change after the box leaves the factory.
Google says it has changed its review process and its firmware integrity checks, but it has not published the details. Researchers will want to see whether the new checks catch code that activates after first boot, the exact gap described here.
For buyers, the safer habits are unglamorous. Prefer devices from manufacturers with a public update record. Check whether a cheap box has a support page and a real firmware history. And treat any streaming hardware that arrives preloaded with unfamiliar apps as a security question, not a bargain.