Google has dismantled a botnet hidden inside TV boxes, and pointed the finger at the company that made them. On November 2, 2026, Google's Threat Intelligence Group published a disclosure titled Shutting the Door on the XCPE Botnet, saying the XCPE botnet had enrolled more than 1.3 million devices across more than 200 countries and regions, the overwhelming majority of them Android TV set-top boxes. Google assessed with high confidence that the backdoor was deliberately built into device firmware, deployed, and operated for financial gain by Videostrong, a manufacturer based in Shenzhen. Google has cut business ties with the company and permanently barred it from making certified Android devices.
The backdoor lived in the firmware, and slept through testing
The core of the XCPE backdoor is a program called x.cpe, which also appears under the name com.oemservice in some firmware builds, and runs with Android system-level privileges. It did not arrive when users downloaded an app; it was written into the firmware before the devices left the factory. Google's investigation says Videostrong kept the backdoor dormant while devices were submitted for testing, evading compatibility and security checks, and only loaded the malicious payload after a device's first boot. Even if removed, the backdoor reinstalls itself from a firmware partition on reboot. The affected devices were not only TV boxes: they also included telehealth equipment, karaoke machines, and digital signage. Videostrong sells TV boxes under its own MECOOL brand while also manufacturing hardware for other brands, so the same backdoor turned up across multiple brands and models. The compromised devices were then rented to criminal groups for advertising fraud, proxy traffic, and installing further malware.
The takedown reached beyond the 1.3 million devices
The disruption operation took place in late October and was only disclosed on November 2. Google worked with Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI, using legal action to seize the botnet's command servers and domains. Google assessed that taking down the affiliated groups' command infrastructure could also cut criminals off from at least 10 million additional infected devices. Those 10 million devices are not part of XCPE itself; they are other devices infected through the same distribution channels. Google also said it has tightened firmware integrity checks for certified Android devices, closing the loophole that let a backdoor sleep through testing and activate after first boot.
Two boundaries need to be drawn. First, the attribution of the 1.3 million devices is an assessment by Google's Threat Intelligence Group, not a court ruling. Second, Google's disclosure offers ordinary users no way to remove the backdoor from devices already shipped; the takedown removed the command end, not the firmware inside each device. For people who bought cheap Android TV boxes, the real trouble is still in the device itself: a backdoor written into factory firmware may not be removed even by a factory reset.
