Google and partners dismantled XCPE, a botnet hidden inside more than 1.3 million Android TV set-top boxes, after finding the device maker built the backdoor into the firmware. Google's Threat Intelligence Group reported on 2 November that it assesses with high confidence Videostrong Technology Co., a Chinese Android device maker, developed, deployed and operated the backdoor for financial gain.

The backdoor, known as x.cpe, sits in the firmware with system privileges and reinstalls itself if a user deletes it. Videostrong sold access to the infected boxes to criminal affiliates, who loaded extra malware onto them and used owners' home connections for ad fraud and residential proxy networks. Two add-ons, Moyu and Bird, are tied by Google to the BadBox operation the FBI warned about in June 2025.

Takedown cuts off servers, not the code on boxes

Google said it used legal action to take down the domains and servers Videostrong used to control the boxes, plus command-and-control domains for over a dozen malware families delivered through the backdoor. It estimates that severs access to at least 10 million additional devices reached through the affiliates' other channels. Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI took part.

TrendAI counted 1,472,554 devices across 206 models in over 170 countries between June and October 2026; the partners settled on a joint figure above 1.3 million because their snapshots differed. Google has also banned Videostrong and any future subsidiaries or affiliates from making certified Android devices.

The catch is that the code is still on the boxes. TrendAI says owners cannot remove it themselves, as it runs as a system app signed by the manufacturer, and as of 5 November Google had published no list of affected models or universal removal tool. Videostrong did not respond to press inquiries.