Key Takeaways
- Google and industry partners dismantled the XCPE botnet of more than 1.3 million Android set-top boxes in late October 2026, and Google said on November 2 that taking down related malware servers should cut criminals off from at least 10 million more infected devices.
- Google assesses with high confidence that Videostrong Technology Co., a device maker in Shenzhen, China, intentionally built the XCPE backdoor into its firmware and sold access to criminal affiliates for ad fraud and residential proxy services.
- Google banned Videostrong and any future subsidiaries or affiliates from building or selling certified Android devices and from supplying software to other certified device makers.
- The XCPE backdoor stays on infected boxes after the takedown and reinstalls itself if removed; TrendAI says cleanup needs vendor action, platform protection, or replacement of the device, and Synthient advises consumers to dispose of the devices.
What happened
Google said on November 2, 2026, that it and industry partners had dismantled the XCPE backdoor, which had enrolled more than 1.3 million set-top boxes into a botnet, a network of infected devices controlled remotely by an attacker. The botnet lost control of its servers in late October in a takedown led by Google, The Hacker News reported.
In its report, the Google Threat Intelligence Group (GTIG) said it assesses with high confidence that Videostrong Technology Co. intentionally developed and operated the backdoor and botnet for financial gain. Videostrong, based in Shenzhen, China, makes Android TV boxes and other devices under its own name and for other brands, according to The Hacker News.
Google said it found the malicious software built into many device models and brands over multiple years. "We believe this campaign wasn't an isolated rogue insider or a development oversight," Google said.
Google worked with Japan's National Police Agency and the security companies Lumen, HUMAN Security, Plume, Synthient, and TrendAI on the operation.
How the backdoor was used
The backdoor, called x.cpe and in some versions com.oemservice, is preloaded in the device firmware and runs with system-level privileges, Google said. If a user uninstalls it, it reinstalls itself when the device restarts. To install software silently, it turns off app checks in Google Play Protect, Android's built-in security feature, according to The Hacker News.
Videostrong made money by selling access to criminal affiliates and loading their malware onto infected devices, Google said. Those add-on programs committed ad fraud, enrolled devices in residential proxy networks without the owners' knowledge, and loaded more malware. A residential proxy service sells access to a home internet connection, so a customer's traffic appears to come from an ordinary household, The Hacker News explained.
Google said it also saw Videostrong's operators take live screenshots, inject keystrokes, copy account information, device information, app lists, and system logs, and open reverse shells, which give a remote command line on the device.
Who is affected
TrendAI, the enterprise business unit of Trend Micro, said its telemetry counted 1,472,554 infected devices across 206 models in more than 170 countries between June 3 and October 1, 2026. Malaysia, Brazil, Iraq, Mexico, and Taiwan had the most devices. The United States, Germany, the United Kingdom, Australia, and Canada each had about 26,000 to 42,000, according to TrendAI.
TrendAI said the operation reported more than 3.8 million distinct home and mobile IP addresses over four months. Because that traffic comes from real household addresses, it passes the reputation and location checks that banks, retailers, and online services rely on, TrendAI said.
Google also took down the control domains of more than a dozen malware families loaded through the backdoor. Because those groups also spread their malware in other ways, Google expects the action to cut off access to at least 10 million more infected devices. BleepingComputer reported that these include retail set-top boxes, karaoke machines, and telehealth hardware, and that not all of them run Android.
How Videostrong was identified
Synthient, which tracks proxy networks and botnets, bought a Mecool KM9Pro Max TV box and found the backdoor preinstalled, The Hacker News reported. Synthient said in its report that it assesses with high confidence that Videostrong is the operator. BleepingComputer reported that Synthient found a document by Videostrong's research and development director on one of the botnet's servers, and that many Videostrong company email addresses had been used to sign the backdoors.
Google's response
Google has cut ties with Videostrong. It banned the company and any future subsidiaries or affiliates from building and selling certified Android devices or supplying software to other certified vendors.
Google requires device makers to pass compatibility and security tests. It said Videostrong hid its code to exploit a gap in those tests and loaded the malicious code after a device's first boot, and that it has changed its review process as a result.
As of November 2, Videostrong's own website listed products it calls "Google certified Android TV box," The Hacker News reported. Google's report does not say how many certified devices were affected. When Google sued over the BadBox 2.0 botnet in July 2025, the more than 10 million devices involved were uncertified, The Hacker News reported. TrendAI said the XCPE operation sits in the same ecosystem as BadBox 2.0.
Google warned that when one part of this criminal supply chain is disrupted, the operators quickly switch to new tools.
What owners and organizations should do
The takedown did not remove the malware from infected devices, BleepingComputer reported. TrendAI said owners cannot remove the implant themselves, so cleanup needs "vendor action, platform protection or replacement of the device." Synthient advises consumers to permanently dispose of the devices because they pose a high risk of containing more malware.
Synthient published a list of device model names seen in the campaign in its public research repository, and warns that a model name alone does not confirm that a device is infected. It advises organizations to look for Mecool or similar devices on their networks, disconnect and dispose of any they find, block the indicators in its report, and keep other connected devices on separate network segments.
Google advises consumers to buy connected devices such as set-top boxes only from reputable manufacturers, and lists its partners on its Android TV website. It also urges users to keep Google Play Protect turned on and to be wary of apps that pay for "unused bandwidth." Google, TrendAI, and Synthient published the indicators of compromise in their reports.