Google Disrupts XCPE Botnet That Infected 1.3 Million Android TV Devices

Google has helped dismantle a massive malware operation that secretly turned more than 1.3 million Android TV streaming boxes into part of a global botnet, exposing a serious security problem involving connected consumer devices.

The operation, known as XCPE, involved malware embedded in the firmware of Android-based devices manufactured by Videostrong Technology, a Chinese electronics manufacturer.

According to Google's Threat Intelligence Group, the company deliberately developed and operated the backdoor to generate revenue by selling access to infected devices to criminal affiliates.

Those affiliates used the compromised devices for advertising fraud, residential proxy networks, and the distribution of additional malware.

The investigation has revealed how an ordinary streaming device connected to a home internet network could become an instrument for cybercrime without its owner's knowledge.

Google announced the disruption on November 3, 2026, following a coordinated operation involving cybersecurity companies and law enforcement partners.

How the Android TV botnet worked

The XCPE operation relied on malware built directly into the firmware of affected devices.

Unlike conventional malware infections that require users to download suspicious applications or open malicious attachments, this backdoor was already present in the device's software before it reached consumers.

Google said the malware was designed to establish communication with remote command-and-control servers, allowing operators to send instructions and install additional malicious components.

The system evolved into a modular, three-stage architecture.

The first component established persistent access to the device. A second component handled the loading and execution of additional software, while separate modules carried out activities designed to generate money for the operators and their affiliates.

This architecture made the operation particularly concerning because the infected devices could be used for several different criminal activities.

Google identified malware components that could turn compromised devices into residential proxy nodes, conduct advertising fraud, and install additional backdoors.

In some cases, the malware could also receive commands to install applications silently, execute shell commands, capture device screens, and inspect local network environments.

The result was a network of consumer devices that could be remotely controlled and monetized without their owners understanding what was happening.

More than 1.3 million devices were affected

Google estimates that more than 1.3 million devices were enrolled in the XCPE botnet.

Although Android TV streaming boxes represented the overwhelming majority of affected hardware, the investigation also identified other Android-based connected devices.

These included telehealth equipment, karaoke machines, and digital signage systems.

This is an important distinction because the security issue was not limited to television streaming products. It involved a broader category of connected hardware built around Android-based systems.

Google said the malware appeared across multiple device models and brands over several years.

The operation was also geographically widespread, demonstrating how compromised consumer devices can become part of international cybercrime infrastructure regardless of where their owners live.

Independent research by TrendAI identified approximately 1.47 million infected devices, slightly above Google's reported estimate.

The difference reflects the findings of separate investigations rather than a confirmed final count of every affected device.

The manufacturer accused of operating the botnet

Google attributed the operation with high confidence to Videostrong Technology Co., an Android original equipment manufacturer and original design manufacturer.

The company reportedly embedded the malicious software in devices and subsequently sold access to criminal affiliates.

This made the incident particularly unusual.

In many malware campaigns, attackers compromise devices manufactured by legitimate companies through vulnerabilities or malicious downloads. In the XCPE case, Google says the manufacturer itself was responsible for building and deploying the backdoor.

The investigation also found that the operation was supported by dedicated infrastructure and changing malware configurations designed to evade detection.

Google said Videostrong used obfuscation techniques to exploit weaknesses in its device certification process, allowing malicious code to be installed after a device's first boot.

The company said it did not consider the incident an isolated insider action or accidental software vulnerability.

In response, Google ended its relationship with Videostrong and banned the manufacturer, including future subsidiaries and affiliates, from producing certified Android devices or supplying software to other certified manufacturers.

Videostrong's alleged involvement is based on Google's investigation and assessment. The company should not be treated as having admitted responsibility unless it issues a verified response.

What cybercriminals were doing with infected devices

One of the most important findings from the investigation concerns how the infected devices were monetized.

Rather than simply using the botnet to launch conventional cyberattacks, the operators created a system that allowed different criminal groups to exploit the devices for financial gain.

1. Residential proxy networks

One of the main activities involved turning infected devices into residential proxy nodes.

A residential proxy routes internet traffic through an ordinary household internet connection. This can make online activity appear to originate from the home network and IP address of an unsuspecting device owner.

Criminals can abuse such networks to conceal the origin of their traffic, distribute automated requests, conduct fraudulent activities, and make their operations harder to trace.

The device owner may experience nothing unusual while their internet connection is being used for activities they never authorized.

2. Advertising fraud

The malware also supported advertising fraud.

In this type of operation, compromised devices can be used to generate artificial advertising activity, including fraudulent impressions and other interactions designed to produce illegitimate revenue.

Because some of these activities run in the background, users may not see anything suspicious on their screens.

3. Additional malware infections

The XCPE backdoor also allowed operators to install additional malicious components.

This created opportunities for other criminal groups to use an already-compromised device as an entry point for further attacks.

A device that initially appears to have a single malware problem can therefore become part of a much larger ecosystem involving several operators and malicious services.

4. Unauthorized access to device functions

Google's technical investigation described the ability of operators to issue commands, capture screens, install applications, and perform network reconnaissance.

These capabilities raise concerns beyond advertising fraud and unauthorized bandwidth usage.

Depending on the device and the permissions available, compromised hardware can expose information about the local network and potentially create additional security risks for connected systems.

Google and cybersecurity partners disrupt the operation

Google worked with several organizations to investigate and disrupt the XCPE infrastructure.

The partners included Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI.

The operation involved legal action against domains and servers used to control the botnet and distribute malicious software.

Google also targeted command-and-control infrastructure associated with more than a dozen malware families that had been distributed through the XCPE backdoor.

The company estimates that disrupting these affiliate command-and-control domains could sever access to at least 10 million additional compromised devices.

That figure is separate from the more than 1.3 million devices identified within the XCPE botnet itself. It represents Google's assessment of the wider impact of disrupting related criminal infrastructure.

Google has also updated its Android TV device security review process to address the techniques used to bypass its previous checks.

Are infected Android TV boxes safe now?

The disruption is an important step, but it does not necessarily mean every affected device has been cleaned.

Taking down command-and-control infrastructure can prevent malware operators from communicating with infected devices and issuing new instructions.

However, malicious software may remain installed in a device's firmware even after its controlling servers have been disabled.

This distinction matters because users should not assume that an affected streaming box has automatically returned to a fully secure state.

Some of the malware components operate with system-level privileges and can persist across reboots.

Google has described the disruption as effectively cutting off the infrastructure used to operate the campaign, but the remaining condition of individual devices can vary.

Owners of potentially affected hardware should check the available device information, consult their manufacturer, and avoid treating an ordinary factory reset as a guaranteed solution to a firmware-level compromise.

How to protect yourself from malicious Android TV boxes

The incident highlights why consumers should be careful when purchasing inexpensive Android TV streaming devices, particularly products from unfamiliar manufacturers or sellers.

A device that offers hundreds of channels or unusually attractive features at a very low price may still introduce significant security risks.

There are several practical precautions users can take.

Buy from reputable manufacturers and sellers. Choose devices with identifiable manufacturers, established support channels, and a clear software-update policy.

Check device certification. Google-certified Android TV products undergo compatibility and security requirements. Certification is useful, although the XCPE incident demonstrates that it is not an absolute guarantee against malicious firmware.

Keep software updated. Install firmware and security updates from official manufacturer channels whenever they are available.

Avoid unknown firmware and applications. Installing unofficial software or modified firmware can introduce additional security problems.

Monitor unusual network activity. Unexpected bandwidth consumption, unexplained network connections, and unusual device behavior may justify further investigation.

Isolate untrusted devices. Where possible, place streaming devices on a separate guest network or isolated network segment rather than giving them unrestricted access to computers, servers, and sensitive business systems.

For organizations, network segmentation and device inventory management can help limit the damage if an insecure connected device is introduced into the environment.

The wider IoT security problem

The XCPE operation demonstrates a growing problem involving the security of internet-connected devices.

Smart televisions, streaming boxes, cameras, routers, medical equipment, and other connected products are increasingly part of everyday life.

However, many consumers focus primarily on price and functionality when purchasing these devices. Firmware security, manufacturer transparency, software maintenance, and long-term support often receive far less attention.

For cybercriminals, this creates opportunities to compromise devices that are poorly maintained or difficult to monitor.

A large number of individually low-value devices can become a powerful criminal infrastructure when they are connected and remotely controlled at scale.

The XCPE incident also shows that security risks can originate much earlier in the supply chain than many users expect.

A device does not necessarily have to be compromised after purchase. In some cases, the software installed by the manufacturer can itself become the source of the threat.

For businesses, this reinforces the importance of evaluating connected hardware before allowing it onto corporate networks.

What the XCPE takedown means for cybersecurity

Google's disruption of the XCPE botnet is a significant development in the fight against large-scale device compromise.

It demonstrates the value of cooperation between technology companies, cybersecurity researchers, and law enforcement agencies in identifying and disrupting criminal infrastructure.

However, taking down one botnet does not eliminate the wider problem.

The same criminal ecosystem can involve multiple malware families, proxy providers, device manufacturers, and distribution channels.

As connected devices become more widespread, manufacturers must take greater responsibility for the security of the software they install, while consumers and businesses need to be more selective about the hardware they trust.

The lesson from XCPE is straightforward: a streaming box may look like an ordinary entertainment device, but if its firmware cannot be trusted, it could become an entry point into a much larger cybersecurity problem.