Google and its cybersecurity partners have disrupted the XCPE botnet, a malware operation that secretly controlled more than 1.3 million Android-based TV streaming boxes. Announced on November 2, 2026, the crackdown targeted the criminal infrastructure used to manage infected devices and install additional malware. However, the operation does not mean that every affected streaming box has been cleaned or permanently secured.
The infected devices were mainly Android-based streaming boxes used to watch movies, television shows, and online content. According to the coordinated botnet takedown announcement, the operation affected more than 1.3 million set-top boxes across more than 200 countries. Many owners were unaware that their devices contained harmful software operating in the background.
Google worked with Japan’s National Police Agency and cybersecurity partners, including Lumen, HUMAN Security, Plume, Synthient, and TrendAI, to investigate and disrupt the XCPE botnet. The coordinated operation targeted internet domains and servers used to control infected devices and deliver additional malware. Google also pursued legal action against the infrastructure supporting the main botnet and several related malware operations.
According to the Google Threat Intelligence Group’s investigation, the XCPE botnet was linked to Videostrong Technology Co., a Chinese manufacturer of Android-based devices. Google’s researchers assessed with high confidence that the manufacturer deliberately developed and distributed the backdoor to generate revenue by providing criminal affiliates with access to compromised devices.
The XCPE malware was embedded in device firmware, the built-in software that controls essential hardware functions. This meant some streaming boxes already contained malicious code before customers purchased them. Google’s investigation found that the manufacturer used techniques to hide the backdoor during security testing and activate its malicious functions after the device’s first startup. Unlike malware spread through suspicious downloads or dangerous links, this threat could reach customers through the normal device manufacturing process.
The incident illustrates how malicious software can reach consumers through trusted manufacturing and distribution processes. Similar security problems are discussed in TechBonafide’s guide to software supply chain attacks, which explains how harmful code can enter products through software components, development systems, or compromised delivery processes.
Once activated, the hidden software connected affected devices to a botnet. A botnet is a network of devices that can be controlled remotely without their owners’ knowledge. Criminals used these connections to generate fake advertising activity, install additional malware, and route internet traffic through household networks.
One major concern was the misuse of home internet connections. The malware could allow third parties to send internet traffic through infected devices, making suspicious online activity appear to come from ordinary households. This created privacy and security risks for users who were unaware of the problem.
Because compromised streaming boxes can use household internet connections without the owner’s knowledge, reviewing connected devices is an important security habit. TechBonafide’s guide to identifying devices on your Wi-Fi network explains how to investigate unfamiliar device names and check which equipment is connected to a router. However, finding a familiar device name does not prove that the equipment is free from malware.
Google also discovered that the malware could collect device information, capture screenshots, and access certain account-related data. The investigation identified capabilities for remotely installing applications, sending commands, and collecting sensitive information without the device owner’s permission. Some malware versions were also designed to disable Google Play Protect, making harmful applications harder to detect.
The investigation revealed that the XCPE operation had developed over several years. The attackers regularly changed their methods to avoid security checks and maintain control over infected devices. Google’s researchers found that the malware had evolved into a more complex system capable of downloading and managing additional harmful software.
Following the investigation, Google ended its relationship with Videostrong Technology and banned the company, including future subsidiaries and affiliates, from manufacturing or selling certified Android devices or supplying software to other certified manufacturers. The restriction applies to Google’s certification ecosystem and does not mean that every existing Videostrong product has been physically removed from customers or retailers.
Google has also strengthened its security review process to identify similar threats in the future. The company is improving how it checks firmware on certified Android TV devices to reduce the risk of harmful software being installed before products reach customers.
Google’s investigation found that the malware used techniques designed to evade device security testing and activate malicious functionality after the first startup. The case shows why manufacturers need stronger firmware checks even when their devices go through certification. Google says it has updated its review process to help detect similar behavior in the future.
The crackdown could also affect a much larger network of compromised devices. Google estimates that disrupting command-and-control servers used by related malware groups could cut criminal access to at least 10 million additional devices. This figure is separate from the 1.3 million streaming boxes linked to XCPE and should not be treated as another confirmed count of infected Android TV boxes.
Disrupting the botnet does not automatically remove the XCPE backdoor from infected streaming boxes. Because the malicious software was embedded in the device’s firmware, ordinary application removal or a factory reset may not eliminate the threat. Affected devices could remain vulnerable even after the attackers’ control servers are disrupted. Owners should rely on verified manufacturer security instructions rather than assuming that resetting the device will make it safe.
Users who own unfamiliar or low-cost Android TV boxes should check whether their devices are officially certified, install trusted security updates, and avoid downloading applications from unknown sources. Anyone who suspects their streaming device contains preinstalled malware should stop using it until its safety can be confirmed.
Regular firmware updates are an important part of maintaining streaming-device security. TechBonafide’s guide on how to update a TV box explains common update methods and precautions. However, users should install only verified updates supplied by their device manufacturer and should not assume that a routine firmware update will remove the XCPE backdoor.
Owners of supported devices can follow Google’s device certification instructions to check their Play Protect certification status. On devices with the Google Play Store, the certification information is available under the store’s settings and About section. Certification is an important security indicator, but it does not guarantee that a device is free from malicious firmware.
Users should also keep Google Play Protect enabled on compatible devices. Google’s official guide to Google Play Protect settings for Android TV explains how to review malware-scanning settings. These protections can help detect harmful applications, but they cannot guarantee the removal of malware already embedded in device firmware.
Anyone who suspects their Android TV box contains preinstalled malware should disconnect it from the internet and contact the manufacturer or retailer for verified security guidance. If the manufacturer cannot provide a trustworthy fix, replacing the device may be the safer option. Users should avoid downloading unofficial firmware files or installing unknown security applications, as these actions can introduce additional risks.
The incident highlights growing security concerns involving smart TVs, streaming boxes, and other internet-connected devices. Households can reduce some risks by checking connected devices, applying trusted updates, and separating smart-home equipment from networks containing sensitive personal information when their routers support that feature. These precautions are consistent with NIST’s smart-home security recommendations, although they cannot remove malware already embedded in device firmware.
Google’s disruption of the XCPE botnet is an important step in limiting cybercrime involving compromised streaming devices. However, the incident shows that malware installed during manufacturing can remain a serious security problem even after criminal servers are taken offline. Consumers should prioritize trusted manufacturers, verified firmware updates, and official security guidance when choosing or maintaining Android TV devices.
