Analysis
Google disrupts the XCPE botnet in 1.3 million Android TV boxes and bans maker Videostrong
Google says XCPE enrolled over 1.3 million boxes and blames Videostrong with high confidence. It bans the maker. Third-party claims are unverified.
On November 2, 2026, the Google Threat Intelligence Group (GTIG) published a report on XCPE, a backdoor that it says enrolled more than 1.3 million devices, mostly Android TV set-top boxes. Google attributes it, with high confidence, to Videostrong Technology Co., an Android OEM/ODM maker based in Shenzhen, and says it has cut ties with the company. This is Google's attribution, not a court ruling. We tested nothing.
The essentials
- What Google says: more than 1.3 million boxes enrolled; attribution to Videostrong with high confidence.
- What Google did: cut ties, banned Videostrong from certified Android devices and took legal action against the botnet's servers.
- What remains: the servers are down, but according to BleepingComputer the backdoor stays on infected boxes, which need clean firmware.
- Not established: where the infection took place, how many boxes are still infected, and Videostrong's response.
What does Google say about the scale and attribution?
Google says XCPE enrolled more than 1.3 million devices, mostly Android TV set-top boxes, plus a few Android IoT devices (telehealth, karaoke, digital signage). Its report lists no countries. Google attributes the backdoor and the botnet to Videostrong, which it says developed, deployed and operated them intentionally, for profit, and sold access to criminal affiliates. Google writes that this was not "an isolated rogue insider or a development oversight".
Separately, Google estimates that its legal action also cuts access to at least 10 million other compromised devices, reached by other routes, from other manufacturers and not all of them Android. These are two distinct figures: do not add them.
Source: Google GTIG report.
How did the software reach the boxes?
According to Google, the main backdoor is preinstalled in the firmware's system partition, runs with system privileges and reinstalls itself from the /oem/ partition if it is uninstalled. It was built into many models and brands over several years. Google says Videostrong used obfuscation to exploit a gap in Google's compatibility and security tests, loading malicious code after the first boot.
Google does not say whether the infection happened at the factory, in the firmware or through an over-the-air update. Synthient, quoted by BleepingComputer, found the malware preinstalled on a MECOOL KM9PRO Max bought in late 2025. So "from the factory" goes further than what Google states.
What measures were taken against Videostrong?
Google cut ties with Videostrong. It banned the company, its future subsidiaries and affiliates from making and selling certified Android devices and from supplying software to certified manufacturers, and from making devices with Google apps preinstalled. BleepingComputer describes this as a revoked license. Google also tightened its review process and firmware integrity checks for certified Android TV devices.
It took legal action to take down the botnet's command domains and servers, and the command domains of more than a dozen malware families loaded as modules. Its partners include Japan's national police, Lumen, HUMAN Security, Plume, Synthient and TrendAI.
What remains on the boxes, and what does Google advise?
The command servers are down, but the backdoor stays on the devices. According to BleepingComputer, the malware is not removed from infected boxes: they need clean firmware, and unplugging them from the network stops the malicious activity. Google, BleepingComputer and Help Net Security add that since August 2026 the operators have used droppers disguised as system apps.
Google's advice to consumers: be wary of apps that pay you to "share your bandwidth", use trusted app stores, check the permissions of third-party VPN and proxy apps, keep Google Play Protect on, and buy boxes from reputable makers through the Android TV partner list.
What is not established?
Source: Google GTIG report and press, read via automatic summaries.
Where the infection took place, and how many boxes are still infected. Videostrong's response: none reported, and Google has not said when or how it found the campaign, according to CyberScoop. Synthient's evidence is reported, not verified by us: an open server directory holding backdoors and a PDF from Videostrong's R&D head, a videostrong.cn domain sharing an IP address with the command server, and Videostrong email addresses used to sign the backdoors. TrendAI's country and United States figures (see the table) are not verified either, and Google's report lists no countries.
Comparison table
| Point | What the sources say | Source |
|---|---|---|
| Scale | More than 1.3 million boxes enrolled, mostly Android TV | Google GTIG |
| Other devices | At least 10 million other compromised devices cut off via other routes (distinct figure) | Google GTIG |
| Attribution | Videostrong, with high confidence, intentional and for profit | Google GTIG |
| Measures | Ties cut; ban on certified Android devices and on preinstalled Google apps | Google GTIG, BleepingComputer |
| Preinstalled box | MECOOL KM9PRO Max bought in late 2025 | Synthient, via BleepingComputer |
| Countries | More than 170; nearly 44,000 devices in the United States (not verified; Google lists none) | TrendAI, via CyberScoop |
| Videostrong's response | None reported | The sources we read |
Frequently asked questions
Does Google say the infection happened at the factory?
No. It says the backdoor is preinstalled in the firmware's system partition and built into many models, without saying where or when (factory, firmware or update). Synthient found one box infected at purchase.
Does the takedown clean the infected boxes?
Not according to BleepingComputer: the servers are down, but the backdoor remains and clean firmware is needed. Disconnecting a box from the network stops the malicious activity.
Are 1.3 million and 10 million the same count?
No. 1.3 million is Google's figure for enrolled boxes. The at least 10 million is a distinct figure for other devices compromised by other routes. Do not add them.
Method and limits
We read Google's GTIG report, BleepingComputer, Help Net Security and CyberScoop through automatic summaries, not in full. A direct read of The Hacker News returned an error (403), so we do not cite it as read. The country and United States figures are TrendAI's, and Synthient's evidence is reported: we verified neither. We found no response from Videostrong. We tested nothing. This is not personalized security advice.
Sources
- Google Threat Intelligence Group, "Shutting the door on the XCPE botnet" (November 2, 2026), read via an automatic summary
- BleepingComputer (Lawrence Abrams, November 2), read via an automatic summary
- Help Net Security (Mirko Zorz, November 2), read via an automatic summary
- CyberScoop (November 2), read via an automatic summary
Spotted an error in this article? Report it · Our corrections policy
