Google says a Shenzhen device maker, Videostrong Technology, built a backdoor into the firmware of Android TV boxes and used it to run an Android TV box botnet of more than 1.3 million devices. Google’s Threat Intelligence Group report, dated November 2, 2026, says the XCPE botnet was taken down last week with Japan’s National Police Agency and several security firms. If you own a cheap, unbranded Android TV box, the practical question is whether yours is one of them, and the honest answer is that nobody has published a model list.
TL;DR: Google says Videostrong Technology preloaded the XCPE backdoor on Android TV boxes and sold access to criminal affiliates. The control servers were taken down, but the malware stays on boxes already sold, and owners cannot remove it. No brands or models were named. The safest move is to stop trusting an uncertified box on your home network.
What the XCPE botnet is
XCPE is a backdoor that shipped inside the firmware of Android set-top boxes, mainly TV boxes. Google’s report says it enrolled more than 1.3 million of them, and it also turned up on Android-based telehealth devices, karaoke machines and digital signage.
Google assesses with high confidence that Videostrong developed, deployed and operated it for financial gain, and that this was not a rogue insider or an oversight. The company allegedly sold access to criminal affiliates, who then loaded their own malware modules.
That matters because the box arrives already compromised. Nothing you install or tap causes it.
How it controlled the boxes
The main package, x.cpe, ran with system privileges and reinstalled itself from the /oem/ partition if someone uninstalled it. It kept a constant connection to an MQTT server, which let operators install apps silently, run shell commands, capture screens and inject keystrokes.
It also switched off Google Play Protect app verification, so extra code could load without the usual checks. Later builds hid from analysis tools, and from August 2026 some droppers posed as system apps.
Google says some boxes ran as many as three residential proxy SDKs at once. Your home connection becomes an exit point for strangers’ traffic, which is the part you would actually feel as a user.
The scale of the Android TV box botnet
TrendAI’s research gives the numbers behind the Google figure. Between June 3 and October 1, 2026, it counted 1,472,554 infected devices across 206 models in more than 170 countries, plus 3,849,226 distinct residential IP addresses. It calls its figures lower bounds because collection was intermittent.
| Measure | Value |
|---|---|
| Devices in the botnet (Google) | More than 1.3 million |
| Devices seen by TrendAI | 1,472,554 |
| Device models seen by TrendAI | 206 |
| Residential IPs used | 3,849,226 |
| Other devices Google expects to lose access | More than 10 million |
Malaysia, Brazil, Iraq, Mexico and Taiwan had the most devices. TrendAI also found roughly 26,000 to 42,000 each in the United States, Germany, the United Kingdom, Australia and Canada, so this is not only a problem elsewhere.
What Google did about Videostrong
Google says it took legal action against the domains and servers that controlled the botnet, and against command domains used by over a dozen malware families the backdoor loaded. It banned Videostrong and any future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors.
It also changed its OEM review process, saying Videostrong used obfuscation to exploit a gap in its tests and load malicious code after a device’s first boot. Google adds that affiliates’ domains going dark should cut off at least 10 million more compromised devices.
Taking servers down does not clean a box, though. TrendAI notes the implant stays on devices already sold, and operators have rebuilt on new infrastructure before. Google itself warns that when one part of this supply chain is disrupted, operators quickly pivot to new loaders.
What to do with an Android TV box at home
Neither report gives a step by step way to check a box, and neither names affected brands. TrendAI says owners cannot remove the implant because it runs as a system app signed with the manufacturer’s key, so fixing it takes vendor action or replacing the device.
Google’s consumer advice is to keep Play Protect active, avoid apps that pay you for “unused bandwidth,” and buy connected devices from reputable makers, with a certified partner list at android.com/certified/partners. For a no-name box bought on a marketplace, replacing it is the cleaner call. That is the detail most coverage will skip: the risk sits in the hardware, not in anything you did.
If you are choosing a replacement, our Fire TV Stick buying guide covers one mainstream option.
Why this one will not be the last
TrendAI says the operation belongs to the same ecosystem as BADBOX 2.0, which was disrupted in March 2025. The same cheap, white-label hardware pipeline keeps producing the problem.
Until preinstalled firmware is checked more strictly, a low price on an uncertified box is a reason to ask where the money is really coming from.
