Google and a coalition of security firms say they have dismantled a botnet that was built into TV set-top boxes before those boxes ever reached buyers. The joint announcement on 2 November 2026, carried by PRNewswire, puts the scale at more than 1.3 million set-top boxes across more than 200 countries, used without their owners’ knowledge for residential proxy traffic, ad fraud and delivering further malware. The uncomfortable part for owners comes in the same announcement: the backdoor lived in the device firmware, and Google says a user cannot remove it, because it reinstalls itself from a protected partition on reboot.
The disruption was led by Google with Plume, TrendAI, Lumen, HUMAN Security and Synthient, working with Japan’s National Police Agency, according to the joint release. BleepingComputer and The Register both confirmed the takedown on 2 November. Google dates the disruption itself only as “last week” in its technical blog, so the exact takedown date remains undisclosed. The overwhelming majority of the infected devices are Android TV set-top boxes, though Google also observed infected telehealth devices, karaoke machines and digital signage hardware.
How did the backdoor get into the boxes?
Unlike infections that require a user to open a suspicious attachment or install an application, XCPE arrived as part of the device itself. The joint release states that the malware, tracked as x.cpe, was embedded in device firmware before set-top boxes reached subscribers’ homes, with no consent request, notification or opt-out for buyers. Google’s blog adds that the main backdoor component runs as com.oemservice in some builds, at Android system privilege level, preloaded in the firmware partition. If a user uninstalls it, it automatically reinstalls from the /oem/ partition when the device reboots.
The backdoor has been evolving for years. Google says that since at least late 2024, the pre-installed malware grew from simple single-stage droppers into a modular, three-stage architecture. In late 2024 the operators began using a separate loader called com.abc.nexus, and since August 2026 they have replaced that loader with smaller, specialised droppers disguised as Android system applications. Once a box starts, XCPE contacts a command-and-control server to obtain connection details for an MQTT message broker, which operators then use to send commands. Google identified a single broker hostname, mqtt.szbboys.com, in the samples analysed to date.
What did the botnet do with the boxes?
The boxes earned money for criminal affiliates in several ways. The joint release lists reselling bandwidth as residential proxy services, delivering video content, ad fraud, and loading additional backdoors, with earlier versions also installing apps for payment. Google’s blog names the module families behind those jobs: residential proxy modules such as Linkfog, AppSalt and NetNut; ad fraud modules such as CBOXTV and HiddenView; and further backdoors such as Moyu and Spirit.
Google says the malware could disable Google Play Protect verification, execute arbitrary shell commands, download and run shell scripts, silently install apps, capture screens, inject keystrokes and perform network reconnaissance. Google also says it observed operators capturing live screenshots, injecting keystrokes, exfiltrating account information, device information, package inventories and system logs, and establishing reverse shells. That is an account of observed operator actions, not a victim count: Google gives no per-user leak figure.
Who stopped it, and what did they actually take down?
The disruption had two halves. The first half is XCPE itself: Google says it took legal action to take down the domains and servers used to control the botnet and install malware modules, and the command-and-control domains for more than a dozen malware families loaded through the backdoor. The second half is the affiliate modules: Google says taking down those affiliate command-and-control domains will sever access to at least 10 million additional compromised devices. Those 10 million are affiliate-module devices reached through other distribution channels, not more XCPE set-top boxes, and Google notes that not all of them are Android devices. Added together, our own arithmetic puts the combined reach at more than 11.3 million devices. That combined figure is our calculation from Google’s two numbers, not a Google claim.
Google also cut ties with the manufacturer it blames. The company assesses with high confidence that the backdoor and botnet were intentionally developed, deployed and operated for financial gain by Videostrong Technology Co., an Android device maker based in Shenzhen, according to The Register. That attribution is Google’s assessment, not a court finding. Google terminated its relationship with Videostrong, revoked its licence to manufacture Android TV devices with preloaded Google apps, and banned the company and its future subsidiaries and affiliates from building certified Android devices or supplying software to other certified vendors. Google says Videostrong used obfuscation to exploit a gap in its compatibility and security tests and load malicious code after first boot, and that it has changed its review process in response. The Register reports that Videostrong did not immediately respond to its inquiries.
One thread of evidence behind the attribution is worth naming precisely. BleepingComputer reports that Synthient traced the backdoor to Videostrong after discovering the malware preinstalled on a MECOOL KM9PRO Max Android TV box it purchased in late 2025, and that Videostrong company email addresses had been used to sign the backdoors. That is a single discovery device, not a list of affected brands or models, and no such list exists in the sources checked. TrendAI, meanwhile, documented more than 3.8 million distinct home and mobile IP addresses connected to the operation between 3 June and 1 October, according to The Register. Those are IP addresses, not devices, and must not be added to the 1.3 million figure.
Is my TV box affected, and what can I do?
There is no check in the sources that lets an owner confirm whether a specific box carries XCPE. No affected brand or model list has been published, no US device count has been given, and Google describes the botnet as globally dispersed with concentrations that may track distributor penetration rather than an even spread. Our own illustrative arithmetic, dividing the lower-bound figures of more than 1.3 million devices by more than 200 countries, gives about 6,500 per country, but both inputs are lower bounds rather than exact totals, so this is threshold arithmetic only, and Google itself warns the spread is uneven, so that average must not be read as any country’s actual figure.
The removal picture is equally stark. Google states that as a system preload, x.cpe cannot be removed by the user, and that it reinstalls from the /oem/ partition on reboot. BleepingComputer, reporting the same limitation, notes that users would need to install clean firmware to remove the infection or disconnect the affected device from the internet to prevent further malicious activity. Neither Google’s blog nor the joint release gives a step-by-step removal guide, and this article does not invent one. Google’s consumer guidance is preventive: be wary of apps offering payment for unused bandwidth or internet sharing, stick to trusted app stores, review permissions for third-party VPN and proxy apps, keep Google Play Protect active, and buy connected devices from reputable manufacturers. The vendor-side actions on record are Google’s domain takedowns, the Videostrong ban, and firmware-integrity improvements for certified Android TV devices.
What is still unknown
Several gaps remain open. The exact date of the takedown is undisclosed beyond Google’s “last week”. No US device count and no affected brand or model list have been published. No per-user data theft volume has been stated. Videostrong has not publicly responded beyond the Register’s note that it did not immediately reply. No step-by-step removal guide has appeared from Google or device vendors. Watch next: a precise takedown date, any US count or brand list, any vendor guidance, any Videostrong response, and any rebuild attempt.
Photo: Oliwier Jaszczyszyn, CC BY-SA 4.0, via Wikimedia Commons.
