Google disrupts XCPE botnet, bans the company behind it

Google shut down the servers behind XCPE, a backdoor hidden in the firmware of Android TV set-top boxes. Google’s Threat Intelligence Group attributes the operation with high confidence to Videostrong Technology, the company that manufactured many of those boxes. More than 1.3 million devices were enrolled.

XCPE malware overview (Source: Google)

The business model was access. Researchers say the company sold entry to its customers’ living rooms to criminal affiliates, who pushed their own modules onto the boxes. Those modules ran hidden ad views, enrolled devices into residential proxy networks that route other people’s traffic through a victim’s connection, siphoned off account details and system logs, and installed further malware. Operators could also take live screenshots, inject keystrokes, and open a shell on the device.

The 1.3 million figure covers the set-top boxes tied to this backdoor. Google estimates that shutting down the affiliates’ command domains cuts off access to at least 10 million more compromised devices, which came in through other routes and other malware families.

“While the overwhelming majority of the infected devices in the XCPE botnet are Android TV set-top boxes, we observed a number of other infected Android-based IoT devices, including telehealth devices, karaoke machines, and digital signage devices,” Google Threat Intelligence Group wrote .

Removing it is the hard part

The main component runs with system privileges and reinstalls itself from a protected partition after a reboot, so deleting the app does not clear the device. It switches off Google Play Protect by rewriting the setting that verifies packages, and it wipes the records of what the user agreed to. Since August 2026, operators have been installing droppers dressed up as system packages that use a privilege escalation exploit to write into the system partition, which makes them harder to dislodge again.

Google took legal action against the domains and servers used to task the botnet and deliver modules, and against the command infrastructure of more than a dozen malware families carried through the backdoor. It banned the company, plus any future subsidiaries and affiliates, from building certified Android devices or supplying software to certified vendors, and cut ties with the company.

Firmware integrity checks for certified Android TV devices have been tightened, and Google changed its review process for manufacturers to close the testing gap that was used. Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI worked on the takedown.

“Compromised-device networks are sustained by profit: operators take control of devices and household connections without consent, then monetise that access through proxy services and various fraud activities. Group action, as exemplified in this operation, interrupts the infrastructure needed for monetisation, raising the cost of operating these networks and weakening the incentives that sustain them,” said Gavin Reid , CISO at HUMAN.