Google and its security partners have disrupted a large cybercriminal network that secretly controlled more than 1.3 million Android-based TV streaming boxes. The malware, known as XCPE, was installed in the devices before customers received them and allowed criminals to use the equipment for advertising fraud and other harmful activities. Although the operation disrupted the attackers’ infrastructure, it does not mean every infected device has been cleaned.
The company announced the development on November 2, 2026. According to the Google Threat Intelligence Group’s investigation, Google and its partners disrupted a malicious network known as XCPE. A botnet is a group of infected devices that criminals can control remotely without their owners knowing. In this case, the affected devices were mainly Android-based TV streaming boxes used to watch movies, television shows, and online content.
Google’s investigators attributed the XCPE operation to Videostrong Technology Co., a Chinese manufacturer of Android-based devices, with high confidence. According to the investigation, the company deliberately included malicious software in device firmware, allowing the backdoor to reach customers through the normal manufacturing and distribution process. This illustrates a hardware and firmware supply-chain threat, similar to the upstream trust risks discussed in our guide to software supply chain attacks.
The hidden software created a secret entry point, known as a backdoor, that allowed outside operators to access infected devices. According to Google’s investigation, Videostrong used techniques that helped the malicious code avoid security testing and become active after the device’s first startup. Once connected, criminals could remotely install additional software, collect information, and control certain device functions. Because the backdoor was installed in the firmware, users might not notice anything unusual while watching television or using streaming applications.
One of the main uses of the infected devices was advertising fraud. Criminals could generate fake online advertising activity to earn money illegally. The compromised devices were also used as residential proxies, allowing other people to route internet traffic through ordinary home connections. This could make suspicious activity appear to come from an innocent user’s internet connection instead of the real operator.
Because compromised streaming devices can use an ordinary home internet connection without the owner’s knowledge, understanding which devices are connected to a router is an important security habit. TechBonafide’s guide to identifying devices on your Wi-Fi network explains how to review connected equipment, although a normal-looking device name cannot confirm that a streaming box is free from malware.
The operation also created serious risks involving personal information and network security. Google’s researchers observed attackers collecting sensitive device and account information, capturing screenshots, sending commands, and installing additional malicious software. These capabilities allowed criminals to use compromised streaming boxes for activities unrelated to watching television. The findings show how an ordinary household device can become a privacy and security threat when unauthorized operators gain access to its system software.
Google’s investigation found that the malware had been included in different device models and brands over several years. The problem was not limited to television equipment. Similar malicious software was also discovered in other Android-based products, including connected healthcare devices, karaoke machines, and digital advertising displays. This suggests that the operation reached beyond ordinary home entertainment systems.
Google worked with Japan’s National Police Agency and cybersecurity partners, including Lumen, HUMAN Security, Plume, Synthient, and TrendAI, to investigate and disrupt the XCPE botnet. Google also pursued legal action against domains and servers used to control infected devices and distribute additional malware. The operation targeted both the main XCPE infrastructure and systems supporting more than a dozen related malware families. These measures were intended to interrupt criminal access to compromised devices and reduce the ability to deploy further malicious software.
Google estimates that the wider operation could also cut criminal access to at least 10 million additional compromised devices connected to related malware networks. This figure is separate from the 1.3 million Android TV boxes identified in the XCPE botnet. It represents the potential wider impact of disrupting the criminal infrastructure, not a confirmed count of additional Android TV infections.
Following the investigation, Google ended its relationship with Videostrong and banned the manufacturer and its related businesses from producing certified Android devices or supplying software to approved manufacturers. Google also strengthened parts of its device security review process to help prevent similar incidents in the future.
The incident highlights an important challenge for Android TV users. Malware installed directly into a device’s firmware can be harder to detect and remove than a harmful application downloaded later. Deleting suspicious apps or performing a factory reset may not solve the problem if the malicious software is built into the device itself.
For routine device maintenance, TechBonafide’s guide on how to update a TV box explains the importance of firmware updates. However, users should follow their manufacturer’s official instructions and should not assume that a normal update or factory reset will remove the XCPE backdoor.
Consumers can reduce their exposure by purchasing streaming devices from trustworthy manufacturers, keeping device software updated, and checking official security notices for affected models. Users should also avoid installing applications from unknown sources and keep built-in malware protection enabled where available. Google’s Android TV Play Protect instructions explain how to manage malware scanning on supported devices. However, Play Protect and normal security updates cannot guarantee the removal of malware already embedded in a device’s firmware. Anyone who suspects a streaming box is compromised should disconnect it from the internet and contact the manufacturer for verified guidance or a replacement.
Home-network security can also reduce the impact of a compromised streaming device. Users can review the devices connected to their router, install available security updates, and consider placing smart televisions and other connected equipment on a separate network from computers containing sensitive information. These precautions are consistent with NIST’s smart-home security guidance, although they do not remove malware already installed on a device.
Google’s disruption of the XCPE botnet represents an important step in limiting criminal activity involving infected streaming devices. However, the incident also reveals how dangerous malware can become when it is installed during manufacturing. The case highlights the need for stronger firmware checks, trustworthy device suppliers, and continued security monitoring. Consumers should remain cautious when purchasing unfamiliar streaming boxes and follow official security guidance when a device is suspected of being compromised.
