Google Dismantles Botnet Hidden in 1.3 Million Android TV Boxes After Maker Accused of Baking In the Backdoor

Google says a trusted Android manufacturer built the botnet itself

Google has dismantled a botnet of more than 1.3 million Android TV set-top boxes, and its accusation against the company behind it is unusually blunt: the manufacturer did not merely fail to spot the infection, Google says, it built the backdoor, ran it for years and sold access to criminals.

According to the Google Threat Intelligence Group, which published its findings on Monday 2 November 2026, the backdoor — known as XCPE, or x.cpe — was embedded directly in the firmware of devices made by Videostrong Technology Co., a Shenzhen-based company that designs and builds Android hardware both under its own brands and for other labels. Google assesses “with high confidence” that the backdoor and the botnet it powered “were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.”

The infected boxes were spread across more than 200 countries, according to Google and its partners. TrendAI, the enterprise security arm of Trend Micro, counted 1,472,554 infected devices across 206 models between 3 June and 1 October 2026, and said the real number was at least that high. The partners settled on a joint figure of more than 1.3 million because their snapshots differed, according to reporting on the operation.

Google says it took the network apart in late October, working with Japan’s National Police Agency and security firms Lumen, HUMAN Security, Plume, Synthient and TrendAI. The company used legal action to seize the domains and servers that controlled the botnet, and it took parallel legal action against the command-and-control domains of more than a dozen malware families that had been loaded onto the boxes through the backdoor. Google assesses that the second part of that action will cut off criminal access to at least 10 million additional compromised devices — hardware infected through other routes, including retail set-top boxes, karaoke machines and telehealth devices, not all of them running Android.

Google has also severed its relationship with Videostrong entirely. The company has been banned, along with any future subsidiaries or affiliates, from building or selling certified Android devices, and from supplying software to other certified vendors. Its licence to ship Android TV hardware with Google apps preloaded has been revoked.

“A device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust, and represents a serious risk to those users,” Google’s threat intelligence team wrote in its report, titled “Shutting the Door on the XCPE Botnet”. “Without users’ knowledge or consent, infected devices were offered as a distribution mechanism for a wide array of criminal actors.”

Charley Snyder, head of disruption operations at the Google Threat Intelligence Group, said the operation showed what coordinated action could achieve. “Operations like this raise the cost for criminals and show that the infrastructure they rely on isn’t out of reach,” he said in a statement issued with the takedown announcement. “Disrupting X.CPE took partners across industry working together.”

A backdoor that arrived with the box

Most botnets begin with a break-in: a vulnerability, a phishing link, a user tricked into installing something. XCPE was different, and that is what makes the case so striking. According to Google, the malware was baked into the product before it ever reached a shop shelf.

The main backdoor component, tracked as x.cpe and running as com.oemservice in some builds, was preloaded in the firmware partition of the devices and ran with system-level Android privileges — the android.uid.system privilege level, which gives it deep control over the device. Its main job was to phone home: on boot, the stub package checked the device’s oem directory for the full backdoor, installed it, and then opened a connection to a command-and-control server.

That connection worked in two stages, according to Google’s technical account. The device first sent an HTTP request to fetch its configuration, geolocation data and network parameters, then opened a persistent connection using MQTT — a lightweight messaging protocol designed for low-bandwidth networks — to a broker hosted at mqtt.szbboys.com. Through that live channel, the operators could issue commands in real time.

The list of things they could do reads like a remote administrator’s toolkit, except that no owner ever granted it. According to Google, the operators could silently download and install additional Android applications, disable Google Play Protect, execute shell commands and scripts with system privileges, capture screenshots and inject keystrokes, collect account information, device details, installed application lists and system logs, carry out network reconnaissance and establish reverse shells into the device.

Google says its analysis of the command data showed that most interactions with victim devices involved installing, uninstalling and configuring modules. But the researchers also observed operators carrying out the sensitive actions directly: capturing live screenshots, injecting keystrokes, exfiltrating sensitive data and running shell scripts, including to open reverse shells.

The backdoor was also built to survive. As a system preload, x.cpe cannot be removed by the user in the ordinary way. According to Google, if it is uninstalled from the device’s data partition, its boot receiver simply reinstalls it from the protected oem partition when the device restarts. BleepingComputer, which reported on the takedown, noted that owners would need to install clean firmware to remove the infection, or disconnect the affected device from the internet to stop further malicious activity.

Three stages, built to evolve

Google says Videostrong had been developing and distributing the malware across multiple device brands and models for years, constantly changing it to evade detection and to serve different criminal affiliates. The report describes a modular, three-stage architecture that the company says has evolved since at least late 2024.

The first stage is the backdoor itself, x.cpe, which handles communications with the command server. The second stage is a loader and execution engine. In late 2024, according to Google — possibly in response to earlier Google enforcement action against a related botnet known as BadBox — Videostrong stripped the money-making modules out of x.cpe and introduced a separate package, com.abc.nexus, to run them. The backdoor kept talking to the control servers and passed instructions to the loader, which did the dirty work. Since August 2026, the operators have begun replacing that loader with smaller, specialised droppers disguised as Android system applications.

The third stage is where the money was made. Videostrong monetised the backdoor, Google says, by loading monetisation modules developed by other entities — criminal affiliates — onto the infected devices. Those modules were delivered as native daemons, as software development kits compiled into the loader’s code, or as secondary apps fetched from malware staging servers. Much of that staging material was hosted as releases on operator-owned GitHub pages, according to Google, with other files on operator-controlled servers and file-hosting sites.

The modules turned the boxes into three kinds of criminal infrastructure at once. Some enrolled the devices into residential proxy networks — services with names including Linkfog, AppSalt, NetNut, GaGaNode and Traffmonetizer — which rent out the internet connection of an ordinary home so that a third party’s traffic appears to come from a real household. Some committed advertising fraud, generating fake ad impressions, loading hidden web pages and clicking advertisements; Google named the ad-fraud modules CBOXTV and HiddenView. And some installed further backdoors, including ones tracked as Moyu, Spirit and Bird, which could download and execute still more malware.

Google says the operators also used obfuscation techniques to exploit a gap in its certification tests, loading the malicious code only after a device’s first boot — after the checks that certified hardware must pass had already run. The company says it has now changed its review process to close that gap and to better safeguard the integrity of firmware on certified Android TV devices.

How the trail led back to the factory

The attribution to Videostrong rests on evidence gathered independently by Google and by Synthient, a security firm that tracks proxy networks and botnets. According to BleepingComputer’s account of Synthient’s investigation, the firm found the backdoor preinstalled on a MECOOL KM9PRO Max Android TV box it had bought in late 2025. MECOOL is one of the brands under which Videostrong sells its hardware.

From there, the trail kept pointing at the same company. Synthient found a publicly accessible directory on the malware’s file server that hosted backdoors used by the operators. The open directory also contained a PDF folder holding a document by Owen Cao, the research and development director of Videostrong Technology Co. Researchers also found that Videostrong’s own domain, videostrong.cn, pointed to the same IP address as mqtt.anyevonline.com, the command-and-control server through which operators listed compromised devices, pushed out commands and managed application installations. In addition, Synthient discovered that numerous Videostrong company email addresses had been used to sign the backdoors, and Google’s report notes a GitHub account named yf-videostrong hosting the relevant packages.

Google says the evidence rules out the two innocent explanations. “We believe this campaign wasn’t an isolated rogue insider or a development oversight,” the company wrote. The malware, it said, was found “built directly into many different device models and brands over multiple years, supported by dedicated infrastructure and constantly evolving configurations to evade detection and manage their affiliates.”

Google has not named any individual at Videostrong in connection with the operation, and neither has the press coverage of the case. No response from Videostrong has been reported. As of 2 November, according to reporting on the case, Videostrong’s own website continued to list products advertised as Google Certified Android TV Boxes and Google Certified Android TV Sticks.

Synthient has published a list of 182 device model names seen in the campaign, which security researchers say is a useful starting point for anyone auditing hardware. Google has not published a complete consumer-facing list of every affected retail model, and it would be wrong to treat every unbranded Android box as infected. What the reporting does establish is that the affected hardware was concentrated in low-cost, off-brand set-top boxes — the kind of device bought online or in discount shops — rather than mainstream, name-brand televisions and streamers.

More than 200 countries, and a much bigger shadow

The scale of the operation is what separates XCPE from an ordinary malware campaign. The botnet itself enrolled more than 1.3 million set-top boxes, according to Google. But the takedown’s wider effect, the company says, reaches far beyond those boxes.

Because the affiliate malware families that rented space on XCPE-infected devices also spread their software through other channels, Google assesses that taking down their command-and-control domains will sever criminal access to at least 10 million additional compromised devices. Those devices include retail set-top boxes, karaoke machines and telehealth hardware, and Google notes that not all of them are Android devices. TrendAI documented more than 3.8 million distinct home and mobile IP addresses connected to the operation between 3 June and 1 October 2026.

The geographic spread was equally broad. Plume, one of the partners in the operation, said the botnet was hidden in more than 1.3 million set-top boxes across more than 200 countries. The backdoor reached Android-based internet-of-things products beyond television boxes, including telehealth devices, karaoke machines and digital signage systems, according to reporting on Google’s findings.

That breadth matters because of what the devices were used for. A residential proxy network does not steal money directly from the person whose box is infected. It rents out their internet connection — silently, without their knowledge or consent — so that someone else’s traffic appears to come from an ordinary home. That traffic can be used for anything from bypassing geographic restrictions and scraping websites to disguising fraud, credential stuffing and other crime. The owner of the box pays the electricity and the broadband bill; the criminal takes the fee.

The advertising fraud worked the same way: the box, sitting quietly under a television, generated ad impressions and clicks that no human ever saw, draining money from advertisers and inflating the numbers of the sites and apps that claimed the traffic. And because the backdoor could install further malware at will, every infected box was also a doorway into the home network it was connected to — able, in principle, to probe other devices on the same Wi-Fi.

Part of a pattern Google has been fighting for years

XCPE is not the first botnet built out of cheap Android streaming hardware, and Google’s report places it firmly inside a pattern the security industry has been tracking for years. The most direct predecessor is BadBox 2.0, a botnet of more than 10 million devices that HUMAN, Google and TrendAI disrupted in March 2025. Google sued over BadBox 2.0 in July 2025. Unlike XCPE, the devices in that campaign were mostly uncertified — hardware that had skipped Google’s approval process altogether.

That distinction is the heart of the XCPE case. Videostrong was not an uncertified outsider. It held a licence to ship Android TV hardware with Google apps preloaded, and its boxes passed the compatibility and security tests that certified devices must clear. According to reporting on Google’s findings, the company describes XCPE as the first documented case of a Play Protect certified maker deliberately embedding a botnet in its products.

The residential proxy economy around these botnets has also been drawing law-enforcement attention. In July 2026, the FBI worked with industry partners to seize hundreds of domains associated with NetNut, a proxy provider, saying the company was responsible for operating a separate botnet called Popa that enslaved TV boxes as residential proxies. NetNut’s software was also among the modules loaded through XCPE, according to Google.

Other names in the XCPE modules list point to the same ecosystem. AppSalt, also known as Honeygain, is owned by the Vilnius-based company Oxylabs, which was relaunched in October 2026 under a new brand called Source after receiving 130 million dollars in funding from the private equity firm Warburg Pincus, in a deal that reportedly valued the business at 3.6 billion dollars, according to reporting on the takedown. The proxy services themselves are not accused of wrongdoing in Google’s report; what the report documents is that their software development kits were routinely downloaded by XCPE-infected devices, turning ordinary living rooms into exit nodes for rented internet traffic.

Synthient, one of the partners in the XCPE disruption, had already published research in January 2026 into the rapid spread of the Kimwolf botnet, which at the time was hammering networks worldwide with record-breaking distributed denial-of-service attacks. The firm tracks proxy providers and botnets as a single, connected economy — and Google’s own report makes the same point. “Backdoor operators, ad-fraud rings, and residential proxy providers operate as an interconnected supply chain,” the company wrote. “Point-in-time disruptions are a critical tool to protect our users, but lasting disruption in this fluid ecosystem will require continued targeting of this infrastructure.”

Analysis: Why It Matters

The trust model just broke in a new place

For years, the advice given to buyers of cheap streaming hardware was simple: stick to certified devices. Certification was supposed to be the line between a bargain and a risk — the guarantee that the box under your television had passed Google’s compatibility and security tests and carried the Play Store and Play Protect. XCPE breaks that line. Videostrong was certified. Its boxes carried Google’s apps. And according to Google, the company used that trusted position to ship a backdoor in the firmware itself, then hid the payload until after the device’s first boot so the certification checks never saw it. The lesson is not that certification is worthless — a certified device from a reputable maker is still a far safer buy than an uncertified one — but that certification is a process, not a promise, and this case shows the process had a hole in it. Google says it has closed that hole. The test of that claim will be whether the next Videostrong is caught by a test, rather than by researchers buying a box and taking it apart.

A botnet as a business, not a break-in

What makes XCPE genuinely different from most malware stories is the business model. This was not a gang breaking into devices; it was a manufacturer treating its own customers’ hardware as inventory. The backdoor was a platform, and the affiliates were tenants: ad-fraud operators, proxy providers and other malware crews paid for access to a ready-made fleet of more than a million boxes, already plugged in, already online, already trusted by the home networks they sat on. Google’s phrase — that Videostrong “monetized the backdoor by selling access to criminal affiliates” — captures a shift in cybercrime that has been building for years. The most valuable asset in this economy is not a clever exploit but a distribution channel: a way to reach millions of devices without ever touching them. A factory can provide that channel more efficiently than any hacker. That is why the attribution matters so much, and why Google’s decision to name a manufacturer, with high confidence, is a far bigger step than another routine takedown announcement.

The proxy economy is the real engine

The most important number in this story may not be 1.3 million but 10 million. Google assesses that taking down the affiliate command servers will cut off access to at least 10 million additional compromised devices, because the malware families that rented space on XCPE boxes also spread through other channels. That is the shape of the modern proxy economy: a set of interlocking services in which a box under a television, a karaoke machine in a bar and a telehealth device in a clinic can all end up as exit nodes for the same rented traffic. The people who buy that traffic are not all criminals — residential proxies have legitimate uses, from market research to content testing — but the supply chain that feeds them has repeatedly been shown to run on devices whose owners never consented. The FBI’s seizure of NetNut domains in July, the BadBox 2.0 disruption in March 2025 and now XCPE all point at the same conclusion: the proxy market’s cheapest supply keeps turning out to be stolen. Until the buyers of proxy traffic are forced to prove their supply is clean, the incentive to infect the next million boxes will remain.

The takedown wins the battle, not the war — the backdoor is still inside

There is a hard limit on what this week’s announcement achieves, and Google is unusually honest about it. The operation took down servers and domains; it did not clean a single device. The backdoor is still sitting in the firmware of every infected box, and because it reinstalls itself from a protected partition on reboot, ordinary cleanup — uninstalling an app, even a factory reset in many cases — will not remove it. The realistic advice for an owner of an affected box is bleak: install clean firmware if that is possible, or disconnect the device and replace it. That is an expensive answer for people who bought a budget box precisely because it was cheap, and it raises a question nobody has yet answered: who pays for the cleanup when the infection was built in at the factory? There is no recall, no refund programme and no compensation announced. The boxes will keep sitting under televisions, dormant but not dead, until their owners throw them away — and the next owner, if the box is resold or handed on, inherits the same implant.

What certification is worth now

Google’s response has two halves, and the second matters more than the first. Banning Videostrong is straightforward punishment; changing the certification process is the structural fix. The company says it has implemented changes to how it ensures the integrity of firmware on certified Android TV devices, after Videostrong exploited a gap in its tests by loading malicious code after the first boot. But the details of those changes have not been published, and the history here counsels caution: BadBox was disrupted, then BadBox 2.0 appeared; the loader changed in late 2024, then changed again in August 2026. The operators adapt faster than the tests. The real test will be transparency — whether Google publishes what it changed, whether other manufacturers are audited against the new checks, and whether the next disclosure comes from Google’s own testing rather than from an outside researcher who happened to buy the wrong box. Until then, the safest advice for buyers has not changed, only sharpened: buy streaming hardware from brands you recognise, keep it updated, and treat a suspiciously cheap Android box from an unknown maker as what it may well be — a bargain with a second owner.

What to Watch Next

1. Google’s certification changes: whether the company publishes details of the new firmware integrity checks, and whether other certified makers are re-tested under them — the difference between a real fix and a press release.
2. The affected-models list: Synthient has published 182 model names seen in the campaign. Watch for a fuller consumer-facing list, and for retailers or regulators naming the brands that carried the backdoor.
3. Any response from Videostrong: the company has not been reported as responding to Google’s attribution. A denial, a legal challenge or silence will each shape how seriously the industry treats the “high confidence” assessment.
4. Law-enforcement follow-up: Japan’s National Police Agency took part in the operation. Watch for arrests, charges or seizures in China or elsewhere — attribution without enforcement has been the pattern so far in the Android box botnets.
5. The proxy crackdown: with NetNut’s domains seized in July and the XCPE affiliate servers now down, watch whether regulators and payment processors move against the residential proxy providers whose software ran on the infected boxes — the demand side of the market.

Sources

• Google Threat Intelligence Group — “Shutting the Door on the XCPE Botnet” (2 November 2026)
• BleepingComputer — “Google disrupts million-device XCPE Android malware botnet, bans TV box maker” (2 November 2026)
• The Hacker News — “Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access” (2 November 2026)
• Plume — “Google Leads Industry Takedown of Botnet Hidden in More Than 1.3 Million Set-Top Boxes across 200 Countries” (2 November 2026)
• Synthient — “The Internals of a BadBox Operation”