XCPE Botnet: Factory Backdoor in 1.3M Android TV Boxes

Google and a group of partners have dismantled the XCPE botnet, a network of more than 1.3 million Android TV boxes that shipped with a backdoor already in their firmware. Google says the culprit was the device maker itself, Videostrong. The same kind of hardware sits in shops, cafes, and offices, so owners should check where their devices came from.

What Google found in the XCPE botnet

On November 2, 2026, the Google Threat Intelligence Group (GTIG) published its report on the XCPE botnet. A botnet is a collection of devices that someone else controls remotely without the owners knowing. Most of the devices in this one were Android TV set-top boxes, the small units that turn an ordinary television into a smart TV.

Google said the takedown happened the week before the report. More than 1.3 million set-top boxes had been enrolled in the botnet. Google also estimates that taking down the command servers used by its affiliates cuts off access to at least 10 million additional compromised devices, which were infected through other routes and other malware families.

What sets this case apart is who was behind it. GTIG assessed with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated by Videostrong Technology Co., an Android device maker that The Register describes as based in Shenzhen, China. Google wrote that the campaign was neither the work of a rogue insider nor a development oversight. Videostrong did not respond to The Register’s questions.

“A device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust, and represents a serious risk to those users,” GTIG wrote.

TV boxes were the largest group, but Google found the same code on Android-based telehealth devices, karaoke machines, and digital signage screens. Digital signage in particular is common in stores, malls, and waiting rooms.

How the factory-installed backdoor works

The core component is an app called x.cpe, sometimes named com.oemservice. It is preloaded on the firmware partition, the part of the system users normally cannot change, and it runs with system-level privileges. According to Google, if a user uninstalls it, the app reinstalls itself from the /oem/ partition every time the device reboots.

Google acknowledged that Videostrong exploited a gap in its testing. The devices passed Android certification because the malicious code only loaded after the first boot, once testing was over. CyberScoop reported that Videostrong sold Android devices that Google had certified.

Videostrong then sold access to the devices to criminal affiliates, who loaded their own modules for three main purposes:

• ad fraud, meaning hidden ad views;
• residential proxies, which route other people’s traffic out through the owner’s internet connection;
• installing more malware.

From its analysis of the command servers, Google listed further capabilities: capturing screenshots, injecting keystrokes, exfiltrating account details and app inventories, and running remote commands. The backdoor also switches off Google Play Protect, Android’s built-in app scanner, so it can install software silently.

The operation kept changing. Google says Videostrong had reworked its preinstalled malware into a three-stage design since at least late 2024. Since August 2026, new packages disguised as system components have been pushed through the MQTT control channel. Help Net Security adds that these droppers exploit a privilege escalation flaw to write to the system partition.

How far it spread and how Google responded

The figures for reach differ between sources. CyberScoop put it at more than 170 countries, while The Register and TrendAI, one of the takedown partners, cite more than 200. According to TrendAI researchers quoted by CyberScoop, the largest concentrations were in Malaysia, Brazil, Iraq, Mexico, and Taiwan. Australia alone had 34,206 infected devices, according to SecurityBrief Australia. None of the available sources gives a figure for Indonesia.

The Register also reported that TrendAI logged more than 3.8 million distinct home and mobile IP addresses linked to the operation between June 3 and October 1. It connected XCPE to BadBox 2.0, a network that infected more than 10 million devices before it was disrupted in March 2025.

The takedown involved Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI. Google took several steps:

1. legal action to take down the domains and servers used to control the botnet, along with the command servers of more than a dozen malware families loaded through the backdoor;
2. a ban on Videostrong, and any future subsidiaries or affiliates, from building certified Android devices or supplying software to certified vendors;
3. changes to its manufacturer review process and stronger firmware integrity checks on certified Android TV devices.

Google’s report does not say whether malware on devices already sold will be removed through an update. Taking down the command servers cuts off the operators, but the preinstalled code remains in the device firmware.

What this means for shops and offices

For home users, the main risks are a hijacked internet connection and stolen account data. For shops, cafes, clinics, and offices, the exposure is wider. TV boxes and digital signage screens often share a network with point-of-sale terminals, admin PCs, or CCTV systems.

A device acting as a residential proxy lends its owner’s IP address to strangers. SecurityBrief Australia notes that this makes malicious traffic look as if it comes from an ordinary home or office, helping it slip past the IP reputation and geolocation checks that banks and retailers rely on. If that traffic is used for fraud or attacks, it is your store’s IP address that shows up in someone else’s logs.

Steps worth taking now:

1. Inventory headless Android devices. List the brand and model of every TV box, signage screen, karaoke unit, or other Android device on your store and office networks. Cheap, unbranded units should be first in line for replacement.
2. Check certification and Play Protect. In the Google Play Store app, tap the profile icon, then Settings, then About to see the Play Protect certification status, as described in Google’s help page. Make sure Play Protect is still on. XCPE shows that certification alone does not guarantee a clean device, so Play Protect switching itself off is a warning sign.
3. Buy from trusted manufacturers. Google recommends choosing devices from the partners listed on its Android TV partner page.
4. Segment the network. Put TV boxes and signage on a separate Wi-Fi network or VLAN, away from checkout terminals and servers. The same principle applies to other IoT equipment, as the case of the hacked French supermarket fridges showed.
5. Monitor and block indicators. IT teams can match the package names and domains Google published, such as x.cpe, com.abc.nexus, and the domain szbboys[.]com, against DNS and firewall logs. Heavy outbound traffic from a device that should only be streaming video also deserves a closer look.
6. Avoid “bandwidth sharing” apps. Google warns that apps offering payment for unused bandwidth are one of the main ways illicit proxy networks grow.

For larger store networks, devices at the point of sale should be treated as managed IT assets, with an inventory, updates, and monitoring. That fits the way a retail management system connects many branches. For organizations running many connected devices, IoT services designed with network segmentation and monitoring from the start reduce the chance of a repeat.

Frequently asked questions

How can I tell if my TV box is part of the XCPE botnet?

Google has not published a list of affected models and offers no check for ordinary users. Warning signs include an unknown brand, Play Protect turning itself off, and heavy internet traffic while the device is idle. IT teams can use the indicators of compromise in Google’s report.

Is uninstalling the suspicious app enough?

No. According to Google, the x.cpe component reinstalls itself from the firmware partition on every reboot. For a device confirmed to be infected, the safest option is to stop using it and replace it with one from a trusted manufacturer.

Are certified Android TV boxes always safe?

Certification still matters, but this case exposed a gap. Videostrong devices passed Google’s tests because the malicious code only loaded after the first boot. Google says it has tightened firmware integrity checks for certified Android TV devices.

Closing thoughts

XCPE shows that a threat can enter through the hardware supply chain before a device ever reaches its buyer. For shops and offices, the practical response is to buy from trusted manufacturers, keep these devices on their own network, and watch their traffic. If you want a review of the connected devices in your organization, Merakit’s cybersecurity team can help.

Sources

• Google Threat Intelligence Group: Shutting the Door on the XCPE Botnet (November 2, 2026)
• CyberScoop: Google shuts down global botnet running on certified Android devices (November 2, 2026)
• The Register: Cops bust botnet of 1.3M infected Android TV boxes (November 2, 2026)
• Help Net Security: Google disrupts XCPE botnet, bans the company behind it (November 2, 2026)
• SecurityBrief Australia: TrendAI helps disrupt X.CPE botnet in 1.3M devices (November 5, 2026)
• Google Play Help: Play Protect certification