XCPE Botnet: How 1.3 Million Android TV Boxes Were Compromised

A backdoor hidden inside an everyday TV device

Internet-connected televisions and streaming boxes are often treated as low-risk household accessories. They are small, inexpensive, and usually left running for long periods, which can make them easy to overlook when people think about cybersecurity. That assumption deserves a second look after Google Threat Intelligence disclosed the disruption of the XCPE botnet on November 2, 2026. Google said the operation had enrolled more than 1.3 million set-top boxes across more than 200 countries. The key detail is that the malicious component was embedded in device firmware before many products reached their owners, rather than relying only on a user downloading a suspicious application.

The incident matters to consumers, device makers, internet service providers, and organizations that deploy connected screens or Android-based equipment. A TV box has an operating system, network access, background services, and sometimes powerful system permissions. If those capabilities are controlled by an unauthorized party, the device can become part of a much larger criminal infrastructure while continuing to perform its normal function on the television.

What was XCPE?

Google's investigation attributed the backdoor and botnet to Videostrong Technology, an Android original equipment and device manufacturer. According to Google's account, the company used XCPE to load additional malicious modules and monetize access by making devices available to criminal affiliates. This is an allegation and assessment reported by Google Threat Intelligence; it should not be generalized to every Android TV product, every device sold under a particular retail label, or every manufacturer in the Android ecosystem.

Google described XCPE as a persistent component that communicated with remote command-and-control infrastructure. The technical analysis identified the use of MQTT for real-time communications in samples examined by researchers. Instructions could be used to install applications silently, execute shell commands and scripts, collect device and network information, and, in some cases, capture screenshots. Google also documented attempts to disable Google Play Protect verification. Those capabilities are especially concerning because a user may have no visible reason to suspect that a television accessory is performing unauthorized background operations.

Why firmware-level malware is different

Many common malware infections begin when a person opens a malicious attachment, installs a fake application, or visits a compromised website. A firmware-level compromise can happen earlier, during manufacturing or software preparation. The buyer may receive a device that already contains an unwanted component. Depending on how the firmware is designed, a system-level package may be difficult to remove and may return after a reboot or factory reset.

Google said obfuscation techniques allowed malicious code to be loaded after the device's first boot, helping it evade parts of the certification process. The company said it has changed its review procedures and strengthened checks intended to protect the integrity of certified Android TV firmware. Certification remains useful, but no certification program can guarantee that every device is free from vulnerabilities or malicious behavior forever. Buyers should also consider the manufacturer's update policy, security history, and ability to provide signed firmware updates.

How the compromised devices were monetized

One major use identified by investigators was residential proxy activity. In a residential proxy network, traffic from a remote customer is routed through an internet connection assigned to an ordinary household. This can make the traffic appear to originate from a home network rather than from a commercial data center. Legitimate bandwidth-sharing services exist, but the XCPE case involved devices being used without the owners' knowledge or consent. Unauthorized proxy traffic can expose a household connection to activity the owner did not initiate and may create reputational, legal, or service-quality problems.

Google also reported modules associated with advertising fraud. Such systems can generate artificial ad impressions, clicks, or other interactions in an attempt to collect revenue dishonestly. The investigation described additional payloads and data collection, including device details, installed-package information, system logs, and sensitive account-related information in observed cases. This does not establish that every affected owner had a password or financial account stolen. It does show that the backdoor provided capabilities that could expose private information and give remote operators control over device behavior.

The modular design is significant. Rather than using one fixed payload for every infected box, the operators could load different components for different purposes. That structure can make a botnet more flexible and harder to investigate: a device might be used as a proxy node, another might run an advertising-fraud module, and others could receive additional software later. It also means that blocking one visible activity does not necessarily remove every capability that was installed on the device.

The coordinated disruption

Google said it worked with Plume, Lumen, HUMAN Security, Synthient, TrendAI, and Japan's National Police Agency. The effort included legal action to take down domains and servers used to control the botnet and distribute malicious modules. Google also said it ended its relationship with Videostrong and barred the company, including future subsidiaries and affiliates, from making certified Android devices with preloaded Google apps or supplying software to other certified vendors.

Google estimated that disrupting command-and-control domains used by criminal affiliates could sever access to at least 10 million additional compromised devices. That figure is Google's estimate, not an independently verified count of devices all infected through XCPE. The distinction matters: the 1.3 million figure describes the XCPE botnet, while the larger estimate concerns access paths used by affiliates and other malware operations. News coverage should keep those numbers separate rather than presenting them as one confirmed infection total.

A takedown of command infrastructure is an important disruption, but it is not the same as cleaning every endpoint. Some devices may retain files, settings, or disabled security features after their connection to the operators is interrupted. The safest remediation depends on the exact model and firmware. Owners should seek a clean, signed update from the manufacturer or service provider. If no trustworthy update is available for a device identified by a reliable advisory, replacing it may be the more prudent option.

What Android TV owners should do

Owners should not assume that a device is infected simply because it is inexpensive, runs Android, or was purchased online. Instead, they should establish exactly what they own. Check the manufacturer, model number, firmware version, and the source from which the device was purchased. Look for an official support page with a clear update history. A generic product name printed on a box is not enough to establish who is responsible for the software or whether security updates are available.

• Install operating-system and firmware updates only through the device's official update mechanism or a verified manufacturer support channel.
• Review installed applications and remove unfamiliar software when the operating system permits safe removal.
• Do not disable Play Protect or other security controls to make an untrusted application work.
• Avoid APK files from unknown websites, unofficial app stores, or links shared in unsolicited messages.
• Use a guest or IoT network for streaming boxes and other smart-home devices when the router supports network segmentation.
• Review router-connected-device lists and investigate unfamiliar devices or unusual, persistent network activity.
• If a trusted security advisory identifies the exact model and no clean firmware is available, disconnect the device and contact the seller or manufacturer about replacement.

A factory reset can be useful for ordinary application-level problems, but it should not be treated as a guaranteed cure for firmware-level malware. If the malicious component is part of the system image or can be restored by a privileged service, a reset may leave the underlying problem intact. Similarly, installing a random “cleaner” APK can introduce another risk. When the device is suspected of having a system-level compromise, a verified firmware reinstallation or replacement is safer than experimenting with unknown tools.

Lessons for manufacturers and the Android ecosystem

The XCPE case highlights the importance of securing the entire device supply chain. Manufacturers should maintain control over firmware signing keys, restrict privileged installation paths, verify software integrity after the first boot, and document the origin of every system component. They should also publish a realistic security-update commitment, provide a way to report vulnerabilities, and continue testing devices after launch. A one-time certification test cannot replace ongoing monitoring and software maintenance.

Platform providers also need processes that account for behavior that occurs after initial setup. Google's statement that it updated its review process is relevant because the reported technique exploited a gap between pre-release checks and code loaded later. Retailers and distributors have a role as well: they should identify the actual manufacturer, avoid relabeling products without software accountability, and make update support clear before purchase.

Why this story matters beyond television

The report also mentioned other Android-based connected products, including telehealth devices, karaoke machines, and digital signage. That broadens the lesson beyond entertainment hardware. Any connected device with a weak update process can become a foothold in a home or business network. A compromised screen in a public venue, for example, may be more than a nuisance if it can route traffic, expose internal network details, or run unauthorized software.

Organizations should maintain an inventory of connected devices, isolate equipment that does not need access to sensitive systems, and replace products that no longer receive security updates. Home users can apply the same principle on a smaller scale by separating smart devices from laptops and work machines where practical. Network segmentation does not remove malware, but it can limit the damage if one device is compromised.

Conclusion: treat streaming hardware as a computer

XCPE is a reminder that a television box is a computer with a network connection, software supply chain, and security lifecycle. Google's disruption effort is a meaningful step against the infrastructure described in its investigation, but owners should still verify their device's model and firmware rather than assuming the takedown automatically repaired every box. The most durable protection comes from buying equipment from accountable manufacturers, installing verified updates, limiting unnecessary permissions, and keeping untrusted devices away from sensitive networks.

Connected devices deserve the same security scrutiny as laptops and phones, even when their only visible job is to stream video.

Primary technical references: Google Threat Intelligence's XCPE analysis and Plume's coordinated-disruption announcement. Consult the original reports before publishing model-specific warnings, because indicators and affected-device lists may be updated as researchers continue their work.