Google and its partners dismantled a botnet called XCPE last week, in the days before Google published its report on November 2, 2026. The backdoor behind it had quietly enrolled more than 1.3 million Android TV set-top boxes into a network of infected devices.
Google assesses, with high confidence, that the backdoor and the botnet were built, deployed and run for financial gain by Videostrong Technology Co. Videostrong is an Android device manufacturer, acting as both an Original Equipment Manufacturer and an Original Design Manufacturer for budget set-top boxes sold under many brand names.
- Backdoor.
- x.cpe, also seen as com.oemservice.
- Manufacturer.
- Videostrong Technology Co., an Android OEM and ODM.
- Devices enrolled.
- More than 1.3 million Android TV set-top boxes.
- Other devices found.
- Telehealth devices, karaoke machines, digital signage.
- Attribution.
- Google Threat Intelligence Group, high confidence, financial motive.
How the Backdoor Reached the Devices Before They Shipped
Google says it found this malicious software built directly into many different device models and brands over multiple years. The code shipped inside the firmware itself, placed there before any device reached a store shelf.
Google requires device makers to pass a suite of compatibility and security tests before a device can ship with Google’s apps. Videostrong used obfuscation to get past those tests, then had the device load its malicious code only after a buyer turned it on for the first time.
A stub package, called x.cpe in some builds and com.oemservice in others, sat preloaded in the firmware partition. It ran at the android.uid.system privilege level, the same level the operating system itself uses.
- x.cpe stub preloaded in device firmwareFactory Firmwareships
- Buyer turns the device on for the first timeFirst Boottriggers
- x.cpe installs itself with system level privilegeSystem Runtimeinstalls
- BootReceiver reinstalls x.cpe if a user removes itSystem Runtimepersists
- x.cpe disables Google Play Protect on the deviceSystem Runtimedisables
- x.cpe opens a channel to the operator’s serverNetworkconnects
- Loader and monetization modules download and runNetwork
What the Pre-Installed Backdoor Could Do
Once active, the pre-installed backdoor disabled Google Play Protect on the device. It did this by calling a function Google names AppUtils.disablePackageVerify, which resets the setting that tracks a user’s consent before quietly turning the built-in scanner off.
From there, Google’s writeup lists a wide set of abilities: silently installing new apps, capturing live screenshots, injecting keystrokes, and exfiltrating account information, device information, package lists and system logs. The backdoor could also run shell commands and open reverse shells, and it carried a network reconnaissance binary to map the device’s surroundings.
Because x.cpe is a system preload, a user cannot remove it outright. If the installed copy is deleted from the app data folder, its own boot receiver reinstalls it from the firmware’s /oem/ partition on the next reboot.
A Three Stage System Built to Keep Running
Google’s report describes a three stage design that evolved since late 2024. Google says the design was built for resilience and for monetizing many affiliates on the same device at once.
The primary backdoor, x.cpe, mainly talks to the operator’s server. A second component, a loader called com.abc.nexus, carries anti-analysis code and handles the work of fetching and running modules. That keeps the riskiest activity a step removed from x.cpe itself.
The third layer is where the money moves. Those modules are not written by Videostrong. They come from separate companies that pay Videostrong for backdoor access. That arrangement turns every one of the 1.3 million devices into a node in a larger botnet that outside operators can rent.
Google names several of the module families it found. Residential proxy and bandwidth-sharing modules came from Linkfog, Honeygain and AppSalt, NetNut and Popanet, GaGaNode and EarnFM. Ad-fraud modules came from CBOXTV and HiddenView, and some devices loaded still more backdoors, named Moyu, Spirit, Bird and Fission. Moyu and Bird were previously tied to Google’s earlier BadBox enforcement action.
Beyond Set-Top Boxes
Most of the infected devices Google found are Android TV set-top boxes, the kind sold cheaply online as media streamers. Google also found the same backdoor on other Android-based hardware, including telehealth devices, karaoke machines and digital signage units.
XCPE is not the only case of a botnet grown from hardware compromised before sale, rather than malware a user installed afterward. Brandefense’s own library tracks a separate example, a firmware-level botnet built from compromised network devices, as one point of comparison for defenders weighing this kind of risk.
How Google and Its Partners Took the Network Down
Google lists four actions it took to disrupt XCPE. It brought legal action to take down the domains and servers Videostrong used to control the botnet and push malware modules. It brought a separate legal action against the command and control domains used by more than a dozen malware families loaded through the backdoor.
Google also banned Videostrong, and any future subsidiary or affiliate of Videostrong, from building or selling certified Android devices, or from supplying software to other certified vendors. Alongside that, Google says it is changing how it checks the integrity of firmware on certified Android TV devices going forward.
Google says it worked closely with Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI to study the malware ecosystem and help disrupt its operation. The scale of the case, Google notes, came from compromising the software supply chain at the manufacturing stage, rather than attacking one device or one buyer at a time.
Why Google Says This Is Not the End
The affiliate module families Google disrupted do not rely on XCPE alone; Google says they run their own distribution channels on other infected hardware too. Because of that spread, Google assesses that taking down their command and control domains will sever access to at least 10 million additional compromised devices beyond the XCPE botnet itself.
Google says backdoor operators, ad-fraud rings and residential proxy providers operate as an interconnected supply chain. Point-in-time disruptions like this one help, Google says, but lasting results need continued targeting of that infrastructure. The company says this disruption will have a significant effect on the operation, but describes it as one step in an ongoing effort rather than a final result.
What This Means for Buyers and Defenders
Google’s own advice centers on where a device comes from. The company recommends buying connected devices, including set-top boxes, only from manufacturers on its published Android TV partner list, and keeping Google Play Protect active rather than disabled.
Google also urges users to review the permissions granted to third-party VPN and proxy apps. Silent enrollment in bandwidth-sharing networks was the most common way the affiliate modules monetized infected devices.
We recommend that security teams treat unmanaged smart TV boxes and similar consumer IoT hardware on a corporate or home network the same way they would an unmanaged laptop. Google’s findings show that a single infected device ran as many as three separate residential proxy services at once. Network logs showing one device making unusually varied outbound connections are worth a closer look.