Back Varindia

TV Box Maker's Backdoor Built a 1.3 Million-Device Botnet

Varindia • November 10, 2026

Google has disrupted a massive botnet built from more than 1.3 million Android TV set-top boxes. It says the botnet was created on purpose by the devices’ own manufacturer, Shenzhen-based Videostrong.

Google says it is highly confident that Videostrong deliberately built a backdoor into many of its device models and sold criminals access to the resulting network, known as x.cpe or XCPE. The company does not blame a rogue insider or an accident.

The backdoor ran as a system app with deep access to the device, and it switched off Google Play Protect’s checks so it could install software silently. Criminals used the boxes for ad fraud and for residential proxy services, which route other people’s traffic through owners’ internet connections. They could also capture screenshots, log keystrokes and take remote control.

Researchers at TrendAI counted almost 1.5 million infected devices across 206 models, with the highest numbers in Malaysia, Brazil, Iraq, Mexico and Taiwan. Videostrong reportedly hid the malicious code to pass Google’s certification tests, then loaded it after the device was first switched on.

In late October, Google used legal action to seize the botnet’s control servers, working with Japan’s National Police Agency and security firms including Lumen and HUMAN Security. It has also banned Videostrong from building or supplying certified Android devices.

Because the backdoor sits in the firmware, it survives restarts, and experts disagree on whether a factory reset is enough. Owners of cheap, unbranded TV boxes should check published model lists and consider replacing the device.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Google Dismantles XCPE Botnet of 1.3 Million Android TV Boxes Google has dismantled a botnet of over 1.3 million Android TV boxes, which were compromised by a backdoor embedded by the manufacturer, Videostrong Technology. The malware, known as XCPE, allowed criminals to hijack devices for advertising fraud and other malicious activities. The backdoor bypassed Google’s certification checks, as it was installed after the initial setup. Google has severed ties with Videostrong and taken legal action to dismantle the botnet's control servers. Trend Micro estimates that approximately 1.47 million devices were infected globally, with significant numbers in countries like Malaysia and Brazil. The malware remains difficult to remove as it can reinstall itself from protected system partitions. Google has closed the loophole that allowed the infection and banned Videostrong from producing certified devices. The incident raises concerns about the potential for AI-driven malware to autonomously replicate across devices. 3 sources 58

Extracted Entities

TV Box Maker's Backdoor Built a 1.3 Million-Device Botnet

The full story

Extracted Entities

Attack Types (2)

Companies (1)

Countries (5)

Malware (1)

MITRE ATT&CK (2)

Platforms (1)