Google has officially dismantled the “XCPE” botnet, a malicious network that secretly infected more than 1.3 million Android TV set-top boxes across over 200 countries. The operation, which was disclosed by Google’s Threat Intelligence Group on November 2, 2026, targeted devices that had been compromised at the firmware level. By working alongside international partners including Japan’s National Police Agency, Synthient, and Trend Micro, the tech giant successfully disrupted the command-and-control infrastructure used by the attackers to manage the hijacked hardware.
The investigation pointed to Videostrong Technology Co., a Shenzhen-based original equipment manufacturer, as the entity responsible for embedding the backdoor into device firmware. Google has stated with “high confidence” that the company intentionally facilitated the creation of this botnet, which allowed criminal affiliates to monetize the compromised devices by tracking user activity and selling access to residential internet connections. Following the investigation, Google has permanently banned Videostrong and its subsidiaries from manufacturing certified Android devices or providing software to other certified vendors, effectively cutting them off from the Android ecosystem.
Infrastructure Disruption vs. Device Safety
While the takedown marks a significant blow to the botnet’s operations, the reality for consumers is more complex. Google’s action focused on shutting down the domains and servers that controlled the infected boxes, but it did not remove the malicious software residing on the hardware itself. Because the malware was installed as a system-level app, it remains present on affected devices, and Google Play Protect remains disabled on those units. Researchers have noted that because the backdoor is part of the firmware, a simple factory reset or app uninstallation is often ineffective at purging the threat.
The scope of the infection is global, with the highest concentrations of compromised devices reported in Brazil, Malaysia, Iraq, Mexico, and Taiwan. However, tens of thousands of infected units were also identified in the United States, Germany, the United Kingdom, Australia, and Canada. While Google estimates that the disruption has severed control over approximately 10 million devices that were reached through broader distribution channels, the actual number of actively infected devices remains a subject of analysis. For instance, Trend Micro reported a total of 1,472,554 infected devices, a figure slightly higher than the initial estimates provided by Google.
Identifying Affected Hardware
The botnet primarily impacted budget, unbranded, or “white-label” Android TV boxes rather than mainstream, name-brand streaming devices. Researchers at Synthient analyzed specific hardware, such as the MECOOL KM9PRO Max, and successfully traced the backend infrastructure back to Videostrong. The malicious software, which operated under package names like x.cpe and com.oemservice, was capable of performing a wide range of unauthorized actions, including capturing screenshots, injecting keystrokes, and silently installing additional applications without user consent.
Beyond simple data theft, the botnet was used to enroll devices into residential proxy networks. By routing traffic through unsuspecting users’ home connections, the operators were able to mask fraudulent advertising and other illicit activities. Investigators identified several modules associated with proxy services such as Linkfog, AppSalt, Honeygain, NetNut, and Traffmonetizer, with some individual devices running multiple proxy kits simultaneously.
Google is currently updating its certification processes to prevent similar loopholes from being exploited in the future. However, because Android is an open-source platform, many uncertified devices remain in circulation that fall outside of Google’s direct oversight. While Videostrong is now prohibited from using Google’s apps and services, the company could theoretically continue to produce hardware under different brands. Nevertheless, the dismantling of its primary command-and-control infrastructure forces any future operations to be built from the ground up, significantly increasing the difficulty for such actors to maintain a large-scale botnet.
