Skip to content
Google Disrupts XCPE Botnet in 1.3 Million Android TV Boxes

Google Disrupts XCPE Botnet in 1.3 Million Android TV Boxes

First seen 2 Nov 2026, 15:43 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 3, 2026 at 15:15 UTC
  • •Over 1.3 million Android TV boxes were infected with the XCPE botnet, primarily from Videostrong.
  • •The backdoor allowed for ad fraud, data theft, and unauthorized access to users' internet connections.
  • •Google has banned Videostrong from producing certified Android devices and expects to disrupt access to at least 10 million more devices.

Google has dismantled a botnet known as XCPE, which infected over 1.3 million Android TV set-top boxes, primarily manufactured by Videostrong Technology Co. The malware, embedded in the firmware, allowed cybercriminals to remotely control devices for ad fraud and data theft. Google has banned Videostrong from its certified Android ecosystem and severed ties with the company, citing intentional development of the backdoor for financial gain. The operation also affected telehealth devices and karaoke machines, with estimates suggesting that the takedown may cut access to at least 10 million additional compromised devices through related malware. The backdoor, identified as x.cpe, was designed to evade detection and could reinstall itself if uninstalled. Google collaborated with Japan's National Police Agency and several cybersecurity firms to execute the takedown.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 1d ago How this analysis works

Timeline

2026-11-02
Google announces XCPE botnet takedown
Google disclosed the dismantling of the XCPE botnet affecting over 1.3 million devices, attributing it to Videostrong's intentional actions.
BleepingComputer
2026-11-02
Videostrong banned from Android ecosystem
Google cut ties with Videostrong, banning it from producing certified Android devices due to the embedded malware.
Techradar
2026-11-03
Google strengthens security checks
In response to the incident, Google announced changes to its review process for Android device manufacturers to prevent similar issues.
Advanced-Television

More articles in this cluster (95)

Following this threat?

Track Backdoor, Google and CVE-2026-58882 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (154)

1 / 4

Common questions

What devices are affected by the XCPE botnet?
The primary affected devices are Android TV set-top boxes, but the malware was also found on telehealth devices and karaoke machines.
How did Google respond to the XCPE botnet?
Google dismantled the botnet, banned Videostrong from its ecosystem, and strengthened its security review processes.
Can users remove the XCPE malware from their devices?
No, the malware reinstalls itself from the firmware if uninstalled, making it impossible for users to remove it without manufacturer intervention.