Google’s XCPE Takedown Exposes a Bigger Botnet Threat

Last updated: November 3, 2026

Google has disabled servers and command infrastructure behind XCPE, a firmware-based backdoor found in Android TV set-top boxes. More than 1.3 million devices were enrolled in the botnet, while the broader disruption reportedly severed access to at least 10 million other compromised machines reached through different infection paths and malware families.

The operation exposes a wider problem: an Android device can become a durable foothold when malicious code operates below the app layer, restores itself after reboots and turns a household connection into criminal infrastructure.

• More than 1.3 million Android TV set-top boxes were enrolled in XCPE.
• Google linked the operation with high confidence to Videostrong Technology.
• The botnet supported residential proxy services, hidden advertising, data theft, remote control and further malware delivery.
• Google banned Videostrong, along with any future subsidiaries and affiliates, from the certified Android ecosystem.
• The disruption targeted command infrastructure used by more than a dozen malware families.

How the XCPE backdoor took hold

According to Google’s Threat Intelligence Group, Videostrong manufactured many of the affected Android TV boxes and embedded the XCPE backdoor in their firmware. Its main component ran with system privileges and reinstalled itself from a protected partition after a reboot. Deleting the visible application therefore did not remove the compromise.

The malware also disabled Google Play Protect by rewriting the setting that verifies packages. It erased records of what users had agreed to, making the intrusion more difficult to investigate. Since August 2026, operators have also installed droppers disguised as system packages. These use a privilege escalation exploit to write into the system partition, creating another obstacle to removal.

The result was more than unwanted software. Operators could take live screenshots, inject keystrokes, open a shell and install additional payloads. They could also collect account details and system logs.

The profit came from home connections

The business model was access. Researchers say Videostrong gave criminal partners a way into subscribers’ homes, allowing them to deploy their own modules on the affected boxes.

Those modules performed several jobs. Some generated hidden ad views. Others enrolled compromised devices into residential proxy networks, routing other people’s traffic through a victim’s home connection. The backdoor could also steal account details and system logs or install further malware.

This arrangement turned a compromised household into infrastructure offered to criminals. Device owners lost control of their connection and data, while affiliates gained a concealed distribution channel for additional modules and malware families.

The scope extended beyond the boxes directly tied to the backdoor. Google estimates that shutting down the affiliates’ command domains cut off access to at least 10 million other compromised devices that had entered through other routes and malware families. Those additional devices should not be added directly to the 1.3 million set-top-box figure.

Why the takedown matters

For device owners, the key lesson is that ordinary app removal may not work against firmware-level malware. A component protected by the system partition can return after a restart, while altered security settings and erased consent records can conceal what happened.

For Android manufacturers, the case exposes a different risk. Certified-device security depends on firmware integrity and manufacturer testing, not merely app-store controls. Google tightened firmware integrity checks for certified Android TV devices and changed its manufacturer review process to close the testing gap used by the attackers.

The takedown also raises the cost for criminal operators. Google pursued the domains, servers and command infrastructure involved in controlling XCPE, distributing modules and supporting more than a dozen malware families carried through the backdoor. Google’s bans also removed Videostrong and any future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors.

However, disruption is not the same as remediation. Command domains may be blocked while malicious code remains on individual devices. Recovery ultimately depends on legitimate firmware repairs, stronger manufacturer controls and enforcement of certification requirements.

The threat reaches beyond televisions

Google’s Threat Intelligence Group reported that infected devices were not limited to Android TV set-top boxes. Other affected Android-based IoT products included telehealth devices, karaoke machines and digital signage systems.

That variety changes what is at stake. A compromised set-top box can expose a home connection and provide a path for additional fraud, while compromised devices in healthcare, entertainment or public-facing environments may carry different operational and privacy risks.

It also demonstrates why the botnet problem cannot be solved solely at the television or app level. A backdoor embedded in one product category can provide access to other systems as affiliates expand the modules and malware they deploy.

Decision checklist for a suspected Android compromise

• Disconnect the affected device from the internet to limit its ability to communicate with command infrastructure.
• Check the manufacturer’s official support channels for a firmware update or security notice.
• Do not install a cleanup application offered through unsolicited messages or pop-up advertisements.
• Do not assume a restart has solved the problem; the XCPE component could restore itself from a protected partition.
• If the device continues behaving abnormally, stop using it for sensitive activities and seek manufacturer support or qualified security advice about repair or replacement.

Isolation should come first because other devices may share the same home connection. Cleaning without manufacturer support risks leaving a persistent compromise in place.

What to watch next

The immediate test is whether Videostrong devices receive credible firmware repairs and whether Google’s stricter integrity checks and manufacturer reviews prevent similar backdoors from passing certification.

Broader enforcement will matter too. Sellers and manufacturers that continue distributing uncertified software could weaken the gains made by blocking XCPE’s infrastructure. The takedown’s durability will also depend on how effectively criminals rebuild command networks and move compromised devices into other botnets.

Residential proxy networks remain the larger concern. Even if XCPE’s infrastructure stays down, stolen household connections can still be packaged and sold elsewhere. Google’s operation interrupts the infrastructure needed to monetise those devices, but owners of compromised hardware need firmware-level remediation rather than reassurance based only on blocked domains.

Key takeaways

• Removing an app may not remove firmware-based malware that restores itself after a reboot.
• XCPE turned compromised home connections into criminal infrastructure for proxy services, fraud and further malware delivery.
• Isolation and manufacturer-supported firmware remediation are safer than trusting unsolicited cleanup apps.
• Blocking command infrastructure disrupts botnets but does not guarantee that every infected device has been repaired.
• The 1.3 million-device figure covers XCPE set-top boxes, while the estimated 10 million additional devices were compromised through other routes and malware families.