Google has dismantled the XCPE botnet built into Android TV set-top boxes, after a long investigation by its Threat Intelligence Group. The report, published on November 2, 2026, says more than 1.3 million boxes were infected. The problem was not a normal app that users downloaded by mistake. It was a hidden backdoor placed in the firmware of the devices before they reached buyers, which gave attackers deep control over the box. Google worked with law enforcement and security partners to shut down the control servers, take legal action, and block the company it blames for the scheme.
Quick Facts
| Detail | What we know |
|---|---|
| Botnet name | XCPE |
| Backdoor name | x.cpe, also seen as com.oemservice |
| Devices infected | More than 1.3 million Android TV set top boxes |
| Counted by TrendAI | 1,472,554 infected devices between June 3 and October 1, 2026, described as a lower bound |
| Countries affected | More than 170 countries |
| Largest concentrations | Malaysia, Brazil, Iraq, Mexico and Taiwan, according to TrendAI |
| Company blamed by Google | Videostrong Technology Co., based in Shenzhen |
| Report date | November 2, 2026, by Google Threat Intelligence Group |
| Key warning | Shutting down control servers does not remove the backdoor from an infected box |
What the XCPE Botnet Was and How It Worked
XCPE was not a single virus in the usual sense. It was a network of infected TV boxes that could be controlled from a distance. Each box contained a backdoor called x.cpe, which was also seen under the name com.oemservice. Because the backdoor was preloaded in the firmware, it came with the device itself. It also ran with system privileges, which means it had far more power than a normal app. A normal app asks for permission and can be removed. This backdoor sat much deeper in the system, where ordinary users would not see it and could not easily delete it.
That deep access gave attackers a wide set of tools. The backdoor could install apps silently, run commands, take screenshots, and turn off Play Protect, a safety system meant to catch harmful software. It could also reinstall itself from a special part of the device called the /oem/ partition. That design made XCPE hard to clean and useful to criminals.
Google says the people behind the scheme sold access to criminal affiliates, who used the boxes for ad fraud, data theft and residential proxy traffic. In plain terms, that means fake views or clicks that cheat advertisers, stolen private information, and other internet activity routed through a home device so it looks like it comes from a normal household. For owners, this could mean slower performance, strange behavior, or higher data use, without an obvious warning on screen.
How Google and Its Partners Took the Botnet Down
The takedown was not a single action. Google describes four main steps, carried out with partners including Japan National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI. First, Google took legal action against the control domains and servers used by Videostrong. Those servers were the command center for the botnet. When they are disrupted, the attackers lose their main way to send instructions to infected boxes.
Second, Google took legal action against the command domains linked to more than a dozen malware families that were delivered through the backdoor. This part matters because XCPE was also a delivery system. Once a box was under control, it could be used to spread other harmful software. By targeting those extra command domains, Google aimed to cut off not just XCPE itself, but also the criminal tools that rode on top of it. Google says these affiliate takedowns cut criminal access to at least 10 million additional compromised devices, by its own assessment. That number shows how far the damage spread beyond the TV boxes at the center of the case.
Third, Google banned Videostrong and its future subsidiaries and affiliates from building certified Android devices or supplying software to certified vendors. Losing certification makes it much harder for a maker to sell devices through normal, trusted channels. Fourth, Google changed its firmware integrity checks, which are meant to spot tampering in device software before a device is trusted.
Connected devices in shops, homes and schools can all become targets, as shown by supermarket freezer cyberattacks across 10 countries in Europe. The XCPE case is different in detail, but it carries the same warning: a device that connects to the internet needs trusted software, not just a low price.
Why the Takedown Does Not Clean Your TV Box
It is easy to read the word dismantled and assume every infected box is now safe. Google warning is clear on this point: it is not. Taking down control servers stops the attackers from sending new commands through those servers, but it does not delete the backdoor from a box that already has it. The backdoor is still in the firmware, and because it can reinstall from the /oem/ partition, a simple reset or a normal app removal may not be enough.
For owners, a clean firmware install from a trusted source may be needed, but that is not simple for most users and must come from the maker or a trusted provider, not a random download. For many people, the simpler and safer choice is to disconnect a suspect box and stop using it for accounts, payments or private viewing until its status is clear. If a box installs apps you did not choose or uses far more data than normal, disconnect it first.
Who Was Affected and Where the Boxes Spread
TrendAI counted 1,472,554 infected devices between June 3 and October 1, 2026. The researchers described that figure as a lower bound, which means the true number could be higher. Google overall figure is more than 1.3 million boxes, which fits with that count. The devices were found in more than 170 countries, so this was a global problem, not a local one. TrendAI reported the largest concentrations in Malaysia, Brazil, Iraq, Mexico and Taiwan.
Google has not published a consumer list of affected brands or models, so there is no official lookup tool for your box. One name tied to the backdoor configuration in reporting was the YokaTV player, but that does not mean every similar box is infected, and it does not prove a different brand is safe. Judge risk by where you bought the device, whether it is certified, and whether it shows warning signs, rather than by rumors about a single brand.
Google assesses with high confidence that Shenzhen based maker Videostrong Technology Co., an Android original equipment maker and original design maker, intentionally built, deployed and operated the backdoor for financial gain. Google does not present this as an accident or a third party hack of an innocent factory. Because design and software work can flow into devices sold under different names, the case is wider than one product line.
What You Should Do If You Own an Android TV Box
Start with the basics, and do them in order. First, buy certified devices from trusted sellers when you can. Certification is not a perfect guarantee, as this case shows, but uncertified or unusually cheap boxes from unknown sellers carry a higher risk. Check the seller, the maker name, and the product page before you buy. If the price looks far below similar trusted models and the maker has almost no public history, that is a reason to pause, not a bargain to grab.
Second, keep firmware and apps updated from official sources only. Do not install firmware files from forums, file sharing links or sellers who promise a free unlock. If your box no longer receives updates, or if the maker has disappeared, that is a warning sign. A device that cannot be updated safely should not be trusted with sensitive accounts.
Third, watch how the box behaves. Unwanted apps, settings that change on their own, or Play Protect turning off without your action are all reasons to disconnect it. Disconnecting means unplugging its internet connection, not just turning off the TV. If you are unsure, leave it offline and use a trusted device instead.
Trust in a device depends on who built the software and how it is checked, a theme also seen in Google plans for schools, AI search and guided learning in 2027.
- Buy certified Android TV devices from trusted sellers.
- Keep firmware updated only through official channels.
- Do not sideload firmware or apps from unknown sources.
- Disconnect a suspect box from the internet right away.
- Do not enter banking, email or payment details on a suspect box.
- Ask the seller or maker in writing if the model is affected, and keep the reply.
Frequently Asked Questions
Is my Android TV box infected with XCPE?
There is no official public list of affected brands or models, so you cannot confirm safety from a list alone. Consider where you bought the box, whether it is certified, whether it still gets official updates, and whether it shows warning signs such as unwanted apps or Play Protect turning off. If you have strong doubts, disconnect the box and seek advice from the seller or maker.
Does Google takedown remove the backdoor from my box?
No. The takedown disrupted control servers and legal targets, but it does not delete firmware already installed on a box. Because the backdoor can reinstall from the /oem/ partition, owners may need clean firmware from a trusted source, or they may need to disconnect and stop using the box.
What was XCPE used for?
Google says access was sold to criminal affiliates for ad fraud, data theft and residential proxy traffic. In plain terms, infected boxes could be used to fake online activity, steal data, and route other traffic through a home connection, all without the owner knowledge or consent.
Should I throw away a suspect TV box?
Not at once, but do disconnect it first. Keep it offline, do not use it for private accounts, and check with the seller or maker for a safe firmware option or a return path. If no trusted fix is available and you cannot verify the device, replacing it with a certified model from a trusted seller is the safer choice.
Sources
The facts in this article are based on the following reports:
- Google XCPE Android TV botnet report on Protect Computer
- XCPE botnet Android TV backdoor takedown on Brandefense
- Google shuts down global botnet on Cybernoz
Final Thoughts
The XCPE takedown is good news, but it is not a complete cleanup. Google and its partners cut off the command system, took legal action, banned the maker it blames from certified Android work, and tightened firmware checks. Those steps make it harder for a copycat to follow the same path. At the same time, more than a million boxes may still carry the backdoor in their firmware.
For ordinary viewers, the message is simple. Choose certified devices from sellers you trust, keep software updated through official channels, and act quickly if a box behaves strangely. Disconnect first, ask questions second, and do not trust a suspect box with private accounts while its status is unclear.
