TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Google and partners disrupted the control servers for XCPE, a botnet linked to more than 1.3 million set-top boxes, on which malware had been installed in device firmware. Google says the backdoor can survive app removal and reboot, so owners should treat suspicious boxes as untrusted and isolate or replace them.
Google’s Threat Intelligence Group (GTIG) published its account on November 2, saying the malware was intentionally developed and operated for financial gain by Videostrong Technology Co., a Shenzhen-based Android device maker. Google said the company used infected boxes to provide access to criminal partners. Videostrong did not respond to comment requests from The Record and heise, according to the source report.
Google said the boxes primarily served as residential proxies, routing other people’s internet traffic through owners’ connections, and as tools for ad fraud. GTIG also reported that operators could capture live screenshots, inject keystrokes, collect account and device information, open remote shells and scan local networks. These are capabilities described by Google; the source material does not establish that every infected box was used for each activity.
TrendAI counted 1,472,554 infected devices from June 3 through October 1, 2026, describing the figure as a lower bound. Google’s separate headline estimate was more than 1.3 million boxes. Google also said shutting down servers used by more than a dozen add-on malware families could cut off access to at least 10 million additional compromised devices. That is an estimate, not a device count, and the source report says those devices may include systems that do not run Android.
Protect your TV box from firmware malware
Google says the XCPE botnet used more than 1.3 million set-top boxes with malware embedded in firmware. A server takedown disrupted remote control, but did not remove the backdoor from affected devices.
How the backdoor persists
Google says removing the app or restarting the box may not clear malware embedded in firmware.
A system app with elevated privileges contacts a control server for instructions.
If deleted, the app can restore itself from a protected partition when the box restarts.
The late October takedown interrupted control servers but did not remove code from each box.
Why a compromised box matters
A streaming device can put your home or office connection and nearby devices at risk.
Traffic through your internet
Google says infected boxes were used as residential proxies and for ad fraud.
Remote access capabilities
Google described screenshots, keystroke injection, data collection, remote shells and local network scans.
Actions for owners and network teams
Treat uncertain or suspicious boxes as untrusted, even if they carry a certification.
Why a TV Box Can Reach Beyond Your Home
A compromised streaming box can turn a home or small office internet connection into infrastructure for someone else’s operations. Residential proxy traffic can make activity appear to come from the connection’s owner, while remote access capabilities described by Google could expose information on the box or devices reachable on the same network.
The incident also complicates a common assumption: Google said some affected devices were Play Protect certified. It said Videostrong used obfuscation and loaded malicious code after the first boot to evade checks. Certification is a useful signal, but this case shows it cannot by itself guarantee that firmware remains trustworthy.
For owners, the key practical point is persistence. Google says the backdoor resides in firmware and can reinstall after a reboot if its app is removed. The control-server takedown interrupts remote operation, but does not itself remove the malicious code from each device.
Products Worth Considering
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
Apple Watch Series 8 GPS, 41mm, Midnight Aluminum Case with Midnight Sport Band (S/M)
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Black
As an affiliate, we earn on qualifying purchases.
How the Firmware Backdoor Persisted
GTIG described a system app named x.cpe, called com.oemservice in some builds, embedded with system-level privileges. According to Google, it contacted a control server for instructions and could fetch settings and additional software. If removed by a user, it could restore itself from a protected partition when the box restarted.
Google said the malware design had included a communication stub, a separate loader and revenue-generating modules supplied by partners since at least late 2024. In August 2026, GTIG observed new droppers disguised as Android system apps replacing the loader, which it interpreted as an effort to maintain concealment.
In response, Google said it pursued legal action to take down Videostrong’s control domains and servers, as well as servers associated with more than a dozen malware families. It also said Videostrong and future subsidiaries or affiliates were barred from building certified Android devices or supplying software to certified vendors, and that it had tightened firmware integrity checks. Google worked with Japan’s National Police Agency and security firms including Lumen, HUMAN Security, Plume, Synthient and TrendAI.
““The backdoor and the botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.””
— Google Threat Intelligence Group
What the Takedown Did Not Remove
The source material does not identify every affected model, brand or retailer, so owners may not be able to determine exposure from a product name alone. It also does not provide a public court filing or case number for Google’s legal actions. Google’s reported attribution to Videostrong is a company assessment, and the manufacturer’s response was not available in the cited account.
It remains unclear how many infected devices are still online, how many owners have replaced or isolated them, and whether every affected box received the same malware components. The control-server disruption limits operators’ access, according to Google, but the backdoor remains in firmware and may persist locally. The reported 10 million figure is an estimate spanning devices reached through other malware channels, not a confirmed tally of devices affected by XCPE.
Steps for Owners and Network Teams
Owners can check whether a box is Play Protect certified in its settings or through Google’s certification guidance, but certification alone cannot rule out compromise in light of this incident. Be cautious with no-name or “unlocked” devices and boxes that lack reliable manufacturer support. If a device appears suspicious or its origin is uncertain, treat it as untrusted: disconnect it from the network and consider replacing it. Removing an app or restarting the box is not a dependable cleanup method for the firmware backdoor Google described.
Where replacement is not immediate, placing a TV box on a separate guest network can limit its access to other home or office devices. Businesses should account for consumer streaming hardware among connected devices and avoid relying only on an IP address’s reputation when assessing suspicious traffic. Google said it had changed firmware review procedures; the source material does not give a schedule for further updates or a complete public list of affected products.
Key Questions
Does restarting a suspected TV box remove the malware?
According to Google, the backdoor can reinstall itself from a protected firmware partition after a reboot. Restarting the box or deleting the app is not a reliable removal method.
Does Play Protect certification mean a TV box is safe?
No certification can guarantee that a device is free of malware. Google said some affected boxes were certified and that malicious code was loaded after the first boot to evade checks.
What should I do if I suspect my box is infected?
Disconnect it from your network and consider replacing it. If you continue using it temporarily, isolate it on a guest network so it has less access to other devices.
How many devices did XCPE affect?
Google said the botnet involved more than 1.3 million set-top boxes. TrendAI counted 1,472,554 infected devices between June 3 and October 1, 2026, and called that a lower-bound figure.
Did the takedown remove the backdoor from affected boxes?
The reported action disrupted control servers, according to Google. The source material says the backdoor remains in firmware, so the takedown does not establish that infected devices were cleaned.
Source: Thorsten Meyer AI
