🔍 Read the full analysis: What Happened When Malware Arrived On TV Boxes From The Factory? on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Google said on Nov. 2 that it and industry partners had disrupted the control infrastructure for XCPE, a botnet involving more than 1.3 million set-top boxes. Google alleges manufacturer Videostrong built and operated the firmware backdoor for profit; the disruption cuts off remote control but does not remove the backdoor from affected devices.
Google said on Nov. 2 that it and industry partners had disrupted the control infrastructure of XCPE, a botnet involving more than 1.3 million Android set-top boxes that Google says were infected through a backdoor built into device firmware before sale. Google identified Shenzhen-based manufacturer Videostrong Technology Co. as responsible, alleging the company operated the system for financial gain. The action cuts off the botnet’s remote control, but Google says it does not remove the backdoor from affected boxes.
Google’s Threat Intelligence Group said it worked with Japan’s National Police Agency and security companies Lumen, HUMAN Security, Plume, Synthient and TrendAI. In late October, the partners took legal action to disrupt domains and servers used to control the botnet and distribute malware. Google also said it acted against control servers associated with more than a dozen malware families installed on the boxes as add-ons.
Google described the affected devices as products made by Videostrong, an Android original equipment and design manufacturer that builds devices under its own name and for other brands. The company said it had high confidence in its attribution and accused Videostrong of selling access to criminal partners. Videostrong did not respond to comment requests reported by The Record and heise, according to the source material.
The infected boxes were used mainly as residential proxies, routing outside traffic through owners’ home internet connections, and for advertising fraud. Google also reported capabilities to capture live screenshots, simulate keystrokes, collect account and device information, scan local networks and open remote command shells. These are capabilities described in Google’s report; the source material does not establish that every infected box performed each activity.
Infographic 01 · XCPE in numbers
A botnet that shipped from the factory
Google says the device maker Videostrong built the backdoor into its own firmware and sold access. That is Google’s assessment; Videostrong did not respond to the press.
set-top boxes in the XCPE botnet, the joint figure of Google and its partners. Taken down in late October 2026.
- 1,472,554 infected devices in TrendAI’s own telemetry, 3 Jun to 1 Oct 2026, a lower bound.
- Partner counts differ by snapshot and view, so the joint figure is “more than 1.3 million”.
- 10M+ more devices lost their malware’s control servers: Google’s estimate, not a count.
How one box earns money for criminals
- Built inA system app sits in the firmware and reinstalls itself after a reboot
- Phones homeOn start it fetches settings and keeps a line open to a control server
- Sold onAccess is sold to partners, who push their own modules
- Cashed inResidential proxy, hidden ad views, more backdoors
Your home internet address is the product. Strangers rent it, and their traffic looks as if it came from your living room.
Sources: Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026. Simplified for readers; no indicators or technical details reproduced.
Powered by Thorsten Meyer AI
The Backdoor Survives the Disruption
The case matters because the alleged infection path bypassed the usual user-facing warning signs. Google says the malicious code was embedded in firmware before the boxes reached customers, so owners did not need to click a link or install a suspicious app. Some affected devices were Google-certified, according to the report, making certification alone an insufficient guarantee against this particular supply-chain threat.
For households, proxy activity can make a home connection appear to be the source of traffic generated by someone else. For organizations, compromised TV boxes and other connected devices can become footholds or tools for abuse while remaining outside conventional laptop-focused security checks. Google’s action may stop the operators from issuing commands through the disrupted servers, but it does not make an affected device safe: the backdoor reportedly remains in firmware and can return after a reboot.
Google also estimated that taking down the add-on malware’s control servers would cut access to at least 10 million additional compromised devices. That is the company’s estimate, not a verified count of devices affected by XCPE, and the source material says not all of those devices run Android.
Products Worth Considering
Dell UltraSharp 32 U3226QER 4K Thunderbolt Hub Monitor
Samsung 34-Inch Odyssey G5 Ultra-Wide Curved Gaming Monitor
Dell UltraSharp 27 Thunderbolt Hub Monitor (U2726DER), QHD
As an affiliate, we earn on qualifying purchases.
How the Firmware Infection Worked
Google’s report, titled “Shutting the Door on the XCPE Botnet,” describes a system app named x.cpe in some builds and com.oemservice in others. The app had system-level privileges and was stored in firmware. According to Google, removing it through ordinary means did not solve the problem: a protected partition restored it at the next reboot. The box then contacted a control server to receive settings and instructions.
Google said the backdoor could install additional apps without the owner’s approval and disable Google Play Protect checks before installing them. The report traces the system’s design to at least late 2024, with a stub that contacted the server, a separate loader and money-making modules supplied by affiliates. In August 2026, Google observed new droppers disguised as Android system apps replacing the loader, which it interpreted as an effort to avoid detection.
Google said it had banned Videostrong and future subsidiaries or affiliates from making certified Android devices or supplying software to certified vendors. It also said it had tightened firmware-integrity reviews for certified Android TV devices. The source material reports those steps but does not include a public court filing or case number.
“The backdoor and the botnet “were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group
What the Disruption Did Not Remove
The source material does not identify every affected brand or model, nor does it provide a public list owners can use to check whether a specific device was infected. Google’s broader estimate of at least 10 million additional devices is not a confirmed count, and the material notes that some may not run Android. It also does not establish how many owners’ accounts, files or local networks were accessed.
The malware is reported to persist in firmware after the control servers are disrupted. That leaves an important distinction: the botnet’s operators may have lost the ability to direct the infected boxes through the servers taken down, but the malicious component remains on the device. The source does not say that every backdoor can still communicate with an alternative server or that all affected devices remain actively controlled.
Google has accused Videostrong of operating the system for profit, but the supplied material contains no public court record or company response. The allegations should not be treated as a judicial finding. It is also unclear how many infected devices were Google-certified or whether the revised checks will identify every comparable firmware threat.
Checks for Owners and Google
Owners can check whether a box is Play Protect certified through the device’s Play Store settings, but certification status does not by itself confirm whether a specific box was infected. Google’s report recommends caution with no-name or “unlocked” boxes. If a device is suspected, the source advises treating it as untrusted: unplug it or replace it rather than relying on an app uninstall or reboot to remove the backdoor.
Keeping streaming boxes on a separate guest network can limit their access to other devices on a home or office network. Organizations should include connected devices in their security planning and avoid relying only on IP-address reputation, since proxy traffic can appear to come from a residential connection. Google said it had changed its firmware review process; the source material gives no timetable for further disclosures or for a public device-checking tool.
Further clarity will depend on any additional reporting from Google, law enforcement or affected manufacturers, including whether investigators publish court records and whether device makers identify affected models or offer replacement firmware. Until then, the confirmed points are the disruption of the control infrastructure and Google’s account of the firmware backdoor; the full device list and the extent of individual user impact remain unknown.
Key Questions
What happened to the TV boxes?
Google says malware was embedded in the firmware of more than 1.3 million set-top boxes before they left the factory. The boxes were then used for activities including residential proxy traffic and advertising fraud.
Who does Google say was responsible?
Google’s Threat Intelligence Group attributed the backdoor and botnet to Videostrong Technology Co., saying it had high confidence in that attribution. The source material contains no public court ruling and says Videostrong did not respond to comment requests reported by The Record and heise.
Did the takedown remove the malware?
No. The late-October action disrupted control servers, according to Google, but the backdoor reportedly remains in firmware and can reinstall after a reboot. The source advises against relying on an app uninstall to remove it.
How can I check whether my box was affected?
The source recommends checking the device’s Play Protect certification and being cautious with no-name or “unlocked” boxes. It does not provide a definitive public list of affected models or a tool that can confirm whether a particular device was infected.
What should owners do if they suspect infection?
Treat the device as untrusted: unplug or replace it, and keep TV boxes on a separate guest network where possible. A reboot or app removal may not clear a backdoor stored in firmware.
Source: ThorstenMeyerAI.com
