Google dismantles XCPE, the botnet of 1.3 million Android TV boxes infected by their own maker

Late October 2026. Google and industry partners dismantle the XCPE backdoor, which enrolled more than 1.3 million streaming boxes into a botnet. November 2, 2026. The announcement lands: the botnet was developed, deployed, and operated for profit by Videostrong Technology Co., a certified Android manufacturer. November 2, 2026, again. Google cuts ties with Videostrong and bans it from building devices preloaded with its apps. The headline fits in one line: certified Android TV boxes — presumed safe — were quietly selling their owners’ bandwidth as residential proxy exit nodes.

For a CISO or a network lead, this is not another curiosity item. It is proof that a platform’s certification guarantees nothing about the manufacturer that integrates it — and that the supply-chain threat has changed nature: it is no longer an isolated insider, it is a business model.

What XCPE is

XCPE — also named x.cpe — is a backdoor preloaded into the firmware of Android TV boxes sold under many models and brands, over several years. Its distinguishing feature, stressed by Google, is that it infected Google-certified devices, which is unusual: certification programs impose compatibility and security tests meant to filter out exactly this kind of code.

Videostrong sidestepped those tests through obfuscation: the malicious code was not present at first boot but loaded afterward, exploiting a gap in the review process. The certification therefore covered a state of the device that stopped existing the moment it was actually turned on.

Google assesses with high confidence that the backdoor and botnet were “intentionally developed, deployed, and operated for financial gain” by Videostrong, an Android OEM and ODM. The chosen phrasing — “this campaign wasn’t an isolated rogue insider or a development oversight” — is rare coming from a platform vendor.

A three-stage architecture

Since at least late 2024, Videostrong has evolved its malware from simple single-stage droppers into a modular, three-stage architecture built for resilience and multi-tenant monetization.

The primary backdoor — x.cpe, running as com.oemservice in some builds — operates at the android.uid.system privilege level and lives in the firmware partition. If a user uninstalls it, it reinstalls automatically from the /oem/ partition on reboot, maintaining persistent system access. The loader com.abc.nexus takes over: it thwarts sandbox analysis and configures the monetization modules. The monetization modules, developed by third-party affiliates, turn the device into a residential proxy exit node — Linkfog, AppSalt, NetNut —, an ad-fraud engine — CBOXTV, HiddenView —, or load further backdoors — Moyu, Spirit.

Communication follows a two-step process: an initial HTTP request fetches dynamic configuration, then a persistent MQTT connection receives instructions — silent app installs, arbitrary shell commands, screen captures, network reconnaissance. Most additional modules were hosted as releases on GitHub pages controlled by the operator.

What the boxes were actually doing

The concrete consequence is simple and invisible to the user. An infected device was offered as a distribution mechanism to a wide array of criminal actors: ad fraud, data exfiltration, and above all routing malicious network traffic through its owner’s home connection.

That last point is what touches the network in the strict sense. As a residential proxy exit node, the box lends its home IP address and bandwidth to relay other people’s traffic — the classic technique for evading geoblocks, committing retail fraud, or anonymizing attacks. The owner pays the bill, bears the apparent responsibility for the traffic, and knows nothing about it.

Google also disrupted the command-and-control domains of the affiliate modules. Because those affiliates have diversified distribution channels beyond XCPE, severing their servers would cut off access to “at least 10 million additional compromised devices.”

What Google did

Google’s actions break into four parts: legal action to take down the domains and servers Videostrong used to control the botnet; legal action against the C2 domains of more than a dozen malware families loaded as modules; a ban on Videostrong and its future subsidiaries building certified Android devices or supplying software to other certified vendors; and stronger firmware integrity checks for certified Android TV devices.

The operation was run with Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI. The message is twofold: the platform punishes the manufacturer, and it acknowledges that point-in-time disruption is not enough — backdoor operators, ad-fraud rings, and residential proxy providers form an interconnected supply chain that will need continuous targeting.

What to do now

There is no patch for the end user: the backdoor lives in firmware, and no setting disables it. Recommendations split by role.

For an individual, identify the Android TV box and its maker; Videostrong devices or their white-label brands should be isolated from the network or replaced. For an enterprise network or an ISP, inventory connected Android TV equipment and watch outbound traffic toward unknown MQTT brokers or staging domains. For a security lead, fold this case into supply-chain threat modeling: a certified vendor is not a trusted vendor.

Verdict

The case is judged less on the device count than on what it changes: a platform’s certification no longer covers the manufacturer. If you deploy Android TV or connected equipment in an enterprise, treat firmware as a first-class risk and map what runs beneath the certification layer. If you are an individual, be wary of cheap boxes that behave well but consume network for no reason. The lesson outlives Android: in a supply chain, the weakest link is no longer the flaw you patch — it is the vendor that turned compromise into its business model.

References

• Google Cloud Blog — Shutting the Door on the XCPE Botnet (November 2, 2026)
• Ars Technica — Google dismantles botnet secretly running on 1.3 million Android TV boxes
• BleepingComputer — Google disrupts million-device XCPE Android malware botnet, bans TV box maker
• SecurityWeek — Google Dismantles XCPE Botnet of 1.3 Million Android Devices