By Thorsten Meyer | November 4, 2026 | ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Most malware has to trick its way onto a device. You click a bad link, install a fake app, or forget an update. The malware in this story skipped all of that. According to Google, it was built into the firmware of cheap Android TV boxes before they ever left the factory, and the company that put it there was the manufacturer.
On 2 November, Google’s Threat Intelligence Group (GTIG) said it had worked with industry partners and Japan’s National Police Agency to take apart a botnet called XCPE. It counted more than 1.3 million set-top boxes. Owners saw a normal streaming box. Behind the screen, their home internet connection was being rented out to strangers, and their box was clicking on ads nobody watched.
Here is what the primary reports say, how the numbers were counted, what is still unknown, and what you can do if one of these boxes sits under your TV or in your office.
Key takeaways
- The takedown: In late October, Google and partners cut the XCPE botnet off from its control servers. Google says it involved “more than 1.3 million set-top boxes”. Partner TrendAI counted 1,472,554 infected devices between 3 June and 1 October 2026 and calls that a lower bound.
- The accusation: Google says with “high confidence” that Shenzhen-based device maker Videostrong Technology Co. built and ran the backdoor for profit, selling access to criminal partners. Videostrong did not respond to requests for comment from The Record and heise.
- What the boxes did: Mostly they acted as residential proxies, which route other people’s traffic through your home connection, and as ad-fraud engines. Google also saw the operators take live screenshots, inject keystrokes, pull account and device data, and open remote shells.
- The uncomfortable part: Some infected boxes were Google-certified. Google says Videostrong used obfuscation to slip past its tests by loading the malicious code after the first boot. Google has banned the company from certified Android and changed its review process.
- What it doesn’t fix: The takedown cuts the remote control, but the backdoor stays in the firmware and reinstalls itself after a reboot. An app uninstall does not remove it.
- What to do: Check the box’s Play Protect certification, be wary of “unlocked” or no-name boxes, and treat a suspicious box as untrusted: unplug it or replace it, and keep TV boxes on a separate guest network. Businesses should treat home and office IoT as part of their attack surface and stop trusting IP reputation alone.
Products Worth Considering
Bose QuietComfort Headphones (2nd Gen), Wireless Over-Ear Noise-Cancelling Headphones, Hazelnut Taupe
Samsung Odyssey G4 25-inch FHD Gaming Monitor
Amazon Kindle Scribe Colorsoft, 64GB, 11-Inch Color Display with Premium Pen
As an affiliate, we earn on qualifying purchases.
What Google says happened
The GTIG report, “Shutting the Door on the XCPE Botnet”, was published on 2 November 2026. Its first paragraph carries the whole story: the backdoor and the botnet “were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.”, an Android original equipment and original design manufacturer. That means a company that builds devices for its own brand and for other brands.
Google lists four actions:
- Legal action to take down the domains and servers Videostrong used to control the botnet and push malware.
- Legal action against the control servers of “over a dozen malware families” that were loaded onto the boxes as add-ons.
- A ban: Videostrong and any future subsidiaries or affiliates may no longer build certified Android devices or supply software to certified vendors.
- Tighter checks on the integrity of firmware on certified Android TV devices.
Google worked with Japan’s National Police Agency and the security companies Lumen, HUMAN Security, Plume, Synthient and TrendAI. Google’s estimate of the wider effect is large: because the add-on malware also spread through other channels, it expects the takedown of their control servers to cut off access to “at least 10 million additional compromised devices”. That is an estimate, not a count, and according to BleepingComputer not all of those devices run Android.
Google did not publish the court filing, and I could not find a public case record. So there is no case number or court in this article.
How the backdoor worked, in plain words
Think of the box as a flat with a spare key hidden under the doormat, put there by the builder. The key does nothing on its own. But whoever holds the copy can let anyone in.
According to GTIG, the spare key is a small system app called x.cpe (in some builds com.oemservice). It sits in the firmware with system-level rights. If a user removes it, it reinstalls itself from a protected partition at the next reboot. When the box starts, it phones home, fetches its settings and then keeps a permanent line open to a control server. Through that line, the operators can install apps silently, run commands, capture the screen and scan the local network. Before installing anything, it turns off the app checks of Google Play Protect, the Android feature that is supposed to flag harmful apps.
Since at least late 2024, Google says, the design has had three layers: the stub that talks to the server, a separate loader, and the money-making modules that partners supply. In August 2026, new droppers disguised as Android system apps started to replace the loader. GTIG reads that as another attempt to stay hidden.
Infographic 01 · XCPE in numbers
A botnet that shipped from the factory
Google says the device maker Videostrong built the backdoor into its own firmware and sold access. That is Google’s assessment; Videostrong did not respond to the press.
set-top boxes in the XCPE botnet, the joint figure of Google and its partners. Taken down in late October 2026.
- 1,472,554 infected devices in TrendAI’s own telemetry, 3 Jun to 1 Oct 2026, a lower bound.
- Partner counts differ by snapshot and view, so the joint figure is “more than 1.3 million”.
- 10M+ more devices lost their malware’s control servers: Google’s estimate, not a count.
How one box earns money for criminals
- Built inA system app sits in the firmware and reinstalls itself after a reboot
- Phones homeOn start it fetches settings and keeps a line open to a control server
- Sold onAccess is sold to partners, who push their own modules
- Cashed inResidential proxy, hidden ad views, more backdoors
Your home internet address is the product. Strangers rent it, and their traffic looks as if it came from your living room.
Sources: Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026. Simplified for readers; no indicators or technical details reproduced.
Powered by Thorsten Meyer AI
How the boxes made money
The modules came from other companies and criminal groups, which Google calls affiliates. Most turned the box into a residential proxy. In plain words: someone you have never met rents your home internet address, and their traffic looks as if it came from your living room. Google names several residential proxy software kits it found on the boxes. TrendAI adds an important nuance: pay-for-traffic services “are not necessarily malicious themselves”. The abuse lies in signing up devices without the owner’s consent.
Other modules committed ad fraud. They loaded ads in the background, invisibly, and reported fake views. And some modules installed more backdoors, which could load even more malware. Google found as many as three proxy kits on a single box. Its conclusion: Videostrong “seeks to monetize every infected device to the greatest extent possible.”
TrendAI says the operator sold access through the boxes as “residential proxy and AI gateway services”. That is where this story touches AI directly. Residential proxies are a common tool for traffic that wants to look human, from account takeovers to what Krebs on Security describes as “mass content scraping for AI projects”.
How the 1.3 million were counted
Three numbers circulate, and they measure different things:
- “More than 1.3 million” is the joint figure of Google and its partners. TrendAI explains that the partners’ counts differ slightly depending on when each snapshot was taken and what each could see.
- 1,472,554 is TrendAI’s own count: infected devices across 206 models in more than 170 countries, measured from 3 June to 1 October 2026. Collection was intermittent, so TrendAI calls every figure a lower bound. The operator scheduled its proxy and ad-fraud modules onto about 1.33 million of them.
- “At least 10 million” is Google’s estimate of other devices whose malware lost its control servers in the same operation.
TrendAI also saw 3,849,226 distinct home and mobile IP addresses used as exits over the four months, and about 182,000 household addresses on offer on a typical day. Most devices sat in Malaysia, Brazil, Iraq, Mexico and Taiwan. The United States, Germany, the United Kingdom, Australia and Canada each had roughly 26,000 to 42,000.
Who is Videostrong, and what is proven
Everything about Videostrong’s role is, for now, an assessment by Google and its partners, not a court finding. Google says it does not believe the campaign was “an isolated rogue insider or a development oversight”. It points to code that hands server settings to other Videostrong apps, such as its YokaTV Player, and to a GitHub account used for the botnet’s files that carries the company’s name.
Synthient, a startup that tracks proxy networks, reached the same conclusion with high confidence, according to The Hacker News and BleepingComputer. It found the backdoor preinstalled on a MECOOL KM9PRO Max box bought in late 2025. It also reported a document signed by Videostrong’s R&D director in an open folder on a botnet server, and a Videostrong domain sharing an IP address with the operators’ control panel. Synthient published a list of 182 model names seen in the campaign and warns that “a model name alone is not sufficient to confirm compromise.” Plume says MECOOL devices made up the majority of the devices it saw talking to the same server.
Videostrong did not respond to requests for comment, according to The Record and heise.
The uncomfortable part: some of these boxes were certified
The usual advice for TV boxes is simple: buy a certified device. Google’s own help pages say devices that aren’t Play Protect certified “may not be secure”, and the FBI listed uncertified Android devices as a warning sign when it warned about the BadBox 2.0 botnet in June 2025.
XCPE complicates that advice. Plume says the botnet mixed Google-certified devices and devices running the open-source version of Android without Google’s apps. Google itself says Videostrong “employed obfuscation techniques to exploit a gap in our tests and load malicious code after the device’s first boot”. The Hacker News notes that Google did not say how many certified devices were affected. For comparison, the more than 10 million devices in BadBox 2.0, which Google sued over in July 2025, were all uncertified, according to Google.
My reading: certification still matters. It cuts the risk a lot, and Google has now closed this particular gap. But it is a check at the factory gate, and a manufacturer that wants to cheat can wait until the device is in your living room. That is why the network-level advice below matters as much as the label on the box.
What this means for users: is my TV box one of them?
There is no official lookup tool, and Google has not published a full list of affected models. Here is a practical order of checks, based on the advice of Google, the FBI, TrendAI, Synthient and Malwarebytes:
- Check certification. On the box, open the Google Play Store, tap your profile icon, then Settings, then About, and look for “Play Protect certification”. If it says “Device is not certified”, treat the box as untrusted. Google also lists certified Android TV partners on android.com.
- Look for warning signs. The FBI names boxes sold as “unlocked” or with free access to paid content, unknown brands, app stores outside Google Play, and devices that ask you to switch off Play Protect.
- Compare the model name. If your box is a MECOOL or a white-label box of unknown origin, compare it with Synthient’s published model list. A match is a reason for caution, not proof.
- If in doubt, take it offline. Unplug it, or at least put it on a separate guest network away from your laptop, phone and smart home hub. Then ask the seller or maker for clean firmware or a replacement.
- Don’t rely on an uninstall. The backdoor reinstalls itself after a reboot. Plume recommends a full factory reset; TrendAI says cleaning up needs action by the vendor, platform protection or a new device. Synthient advises consumers to get rid of affected boxes. Replacing the box is the safe choice.
- Change your Wi-Fi password if you remove a suspicious box. TrendAI saw these boxes collect Wi-Fi details.
One more rule from Google: be very wary of apps that pay you for “unused bandwidth”. They are a main route by which proxy networks grow.
Infographic 02 · Is my TV box one of them?
Five checks for the box under your TV
There is no official lookup tool and no full model list. These steps follow the advice of Google, the FBI, TrendAI, Synthient and Plume.
- Check certificationPlay Store → profile icon → Settings → About → “Play Protect certification”. “Device is not certified” = treat it as untrusted.
- Look for warning signsSold as “unlocked” or with free paid content, unknown brand, app stores outside Google Play, asks you to switch off Play Protect (FBI).
- Compare the modelMECOOL or a white-label box of unknown origin? Compare with Synthient’s list of 182 model names. A match is a warning, not proof.
- If in doubt, take it offlineUnplug it, or move it to a separate guest network. Ask the seller for clean firmware or a replacement.
- Change your Wi-Fi passwordafter removing a suspicious box; the boxes collected Wi-Fi details (TrendAI).
- Buying from known makers listed as certified Android TV partners.
- A separate network for TV boxes and other gadgets.
- Replacing a box you can’t trust.
- Keeping Play Protect switched on.
- Uninstalling the app: the backdoor reinstalls itself after a reboot.
- Assuming a factory reset is enough: experts disagree (Plume: reset; TrendAI: vendor fix or new device).
- Treating certification as a guarantee: some XCPE boxes were certified (Plume).
- Apps that pay you for “unused bandwidth” (Google).
General information, not professional security advice. Menu names can differ slightly between devices.
Sources: Google Play Help · FBI PSA, 5 Jun 2025 · Synthient model list · TrendAI, 2 Nov 2026 · Plume, Nov 2026 · Google Threat Intelligence Group, 2 Nov 2026.
Powered by Thorsten Meyer AI
What this means for businesses
- IP reputation is not identity. Traffic from these boxes arrives from the same home broadband networks as your real customers. TrendAI says blocklists of data-center ranges “would not and did not catch this traffic”. Fraud and login teams should combine network fingerprints with behavior, such as repeated failed logins, before trusting an address.
- Home offices are part of your network. A backdoored box sits on the same Wi-Fi as an employee’s work laptop. TrendAI advises companies to treat unmanaged consumer devices on home networks as part of their exposure and keep corporate access behind managed devices.
- IoT in offices, hotels and clinics. Google found the same backdoor in telehealth devices, karaoke machines and digital signage. Inventory every Android-based screen and box, put them on separate network segments, and limit where they may connect.
- Sellers and marketplaces carry responsibility. Google says retailers and distributors should require independent security audits from device makers and swiftly delist manufacturers implicated in supply-chain abuse. TrendAI asks marketplaces that sell white-label TV boxes to require certified firmware.
- Advertisers pay for fake viewers. The ad-fraud modules produced impressions from real home connections, which ad verification treats as genuine audience, according to TrendAI. Ask your ad partners how they filter residential proxy traffic.
If you work with connected devices in buildings, our earlier piece on the second wave of attacks on supermarket refrigeration shows the same lesson from a different angle: the cheapest box on the network is often the weakest door. And for the bigger picture on supply-chain attacks, see AI has taken the clock off cyberattacks.
Infographic 03 · From BadBox to XCPE
Each wave hides a little better
Pre-infected TV boxes are not new. What is new in XCPE: Google says the manufacturer itself ran the botnet, and some boxes passed certification.
- 2023BADBOX identifiedAndroid devices with backdoors installed before purchase (FBI)
- 2024BADBOX disruptedBADBOX 2.0 discovered afterwards (FBI)
- Late 2024XCPE becomes modularSeparate loader plus partner modules; possibly a response to BadBox enforcement (Google)
- 5 Jun 2025FBI warns about BADBOX 2.0Uncertified Android devices named as a warning sign
- 17 Jul 2025Google sues BadBox 2.0 operatorsMore than 10 million uncertified devices, all open-source Android (Google)
- 3 Jun – 1 Oct 2026TrendAI measures XCPE1,472,554 devices, a lower bound
- Late Oct 2026XCPE taken downGoogle and partners, with Japan’s National Police Agency; maker banned (report 2 Nov)
- Don’t trust IP reputation alone: proxy traffic comes from real home broadband.
- Treat unmanaged devices on employees’ home networks as exposure.
- Inventory Android screens and boxes in offices, hotels and clinics; segment them.
- Retailers: require independent firmware audits; delist implicated makers (Google).
- Ask ad partners how they filter residential proxy traffic.
- Court, case number and defendants of Google’s legal action.
- How many infected boxes were certified.
- Whether owners will be notified.
- Where the operators move next.
Sources: FBI PSA, 5 Jun 2025 · Google, 17 Jul 2025 · Google Threat Intelligence Group, 2 Nov 2026 · TrendAI, 2 Nov 2026.
Powered by Thorsten Meyer AI
Where this fits: BadBox, BadBox 2.0, and now XCPE
This is not the first wave. The FBI says the original BADBOX campaign was identified in 2023 and disrupted in 2024. Its successor, BADBOX 2.0, infected devices before purchase and through malicious apps from unofficial stores; the FBI warned about it on 5 June 2025. On 17 July 2025, Google said it had filed a lawsuit in New York federal court against the operators of BadBox 2.0, which it said had compromised more than 10 million uncertified devices.
XCPE has links to that world. Google says two of the add-on backdoors it found on XCPE boxes, called Moyu and Bird, had been seen before as part of the BadBox operation. And it says the late-2024 redesign of the malware may have been “a response to earlier Google enforcement related to BadBox”. Each wave pushes the operators to hide better.
Honest limits: what we don’t know
- The court case. Google says it took legal action but did not publish the filing. We don’t know the court, the defendants or what the court allowed.
- Certified devices. We know some were certified. We don’t know how many.
- Your device. There is no official lookup, and the published model list is not proof either way.
- Clean-up. Google says it will not explain the changes to its review process in detail, according to CyberScoop. It did not say whether owners will be notified, according to The Record. GTIG’s head of disruption operations, Charley Snyder, told The Record that cutting the domains renders the malware “effectively” benign. But the backdoor is still in the firmware, and the experts disagree on whether a factory reset helps.
- What comes next. Google itself warns that the market is “resilient”: when one piece is disrupted, operators “quickly pivot to new loaders or rival monetization SDKs”.
The bottom line
The XCPE takedown is a real win: over a million boxes lost their remote control at once, and a manufacturer lost its Android license. But the lesson is bigger than one company. A cheap box can arrive already compromised, a certification sticker is not a guarantee, and your home internet address is now something criminals rent out. The fix is boring and works: buy from known makers, check certification, keep TV boxes on their own network, and replace a box you can’t trust.
This article is general information for consumers and businesses, not professional security advice.
Sources
- Google Threat Intelligence Group, “Shutting the Door on the XCPE Botnet”, 2 November 2026: cloud.google.com
- TrendAI Research, “TrendAI Research Helps Disrupt Botnet of More Than 1.3 Million Pre-Infected Set-Top Boxes”, 2 November 2026: trendaisecurity.com
- Plume Security Labs, “The X.CPE Botnet: From Device Management to Monetization Framework” (white paper), November 2026: plume.com
- Synthient, list of device model names observed in the campaign, November 2026: github.com/synthient
- Google Play Help, “Check & fix Play Protect certification status”: support.google.com
- Android certified partners: android.com
- Google, “We’re taking legal action against the BadBox 2.0 botnet”, 17 July 2025: blog.google
- FBI, Public Service Announcement “Home Internet Connected Devices Facilitate Criminal Activity”, 5 June 2025: ic3.gov
- Reporting: The Hacker News, 2 November 2026: thehackernews.com · BleepingComputer, 2 November 2026: bleepingcomputer.com · CyberScoop, 2 November 2026: cyberscoop.com · Krebs on Security, 2 November 2026: krebsonsecurity.com · The Record, 3 November 2026: therecord.media · heise online, 3 November 2026: heise.de · Malwarebytes, 3 November 2026: malwarebytes.com
