XCPE botnet: Google disrupts 1.3 million infected Android TV boxes

Google said on Monday, 2 November 2026, that it had disrupted a botnet called XCPE, a network of more than 1.3 million infected devices, most of them Android TV set-top boxes. Google's Threat Intelligence Group said, with high confidence, that the hidden software was built into the boxes' firmware by their maker, Videostrong Technology. Google has ended its relationship with the company, revoked its licence to ship devices with Google's apps and services, and banned it and its future affiliates from making certified Android devices.

A botnet is a large group of internet-connected devices secretly controlled by someone else. Owners usually do not know their device is part of one. Here, the danger came from the factory: the backdoor was placed in the firmware, the basic software that runs the device, before buyers ever switched it on. That is a supply-chain attack, where the threat enters through a product's maker rather than through a user's mistake.

The case matters for device makers and for the rules that govern them. Google's certification programme is meant to assure buyers that an Android device with Google's apps has passed security checks. By hiding its code until after the first start-up, the maker got round those checks for years, Google said. Banning a hardware maker outright is a strong step, and it signals that platform owners will act against suppliers, not only against hackers.

For households, the residential-proxy use is the most direct risk. When a box's internet connection is rented out, other people's traffic, including criminal traffic, can appear to come from the owner's home connection. Ad fraud also slows devices and uses data. And because the malware hides in a part of the firmware that a normal reset does not reach, an infected box cannot be fixed simply by deleting apps.

What can users do? Buy streaming boxes from known brands that state they are certified for Android TV or Google TV; be wary of very cheap, unbranded boxes that promise free channels; and replace a box that is suspected to be infected, since the malware can reinstall itself. Google's report says the overwhelming majority of the infected devices are set-top boxes.

Peepals calculation: Google's estimate of at least 10 million further devices cut off is about 7.7 times the 1.3 million in the XCPE botnet itself (10 ÷ 1.3 ≈ 7.7), so the combined number of devices affected by the takedown is at least about 11.3 million. Our calculation from the reported figures.

Short-term: The criminals behind XCPE lose control of the infected boxes for now, but the devices remain compromised, so owners face a risk if new control servers appear.

Long-term: Device makers that ship Android products face closer checks and the threat of losing Google's certification. Regulators may look again at the security of cheap connected devices that are sold widely online.

Who is affected: Owners of uncertified or low-cost Android TV boxes and other Android-based devices; retailers and online marketplaces that sell them; advertisers hit by ad fraud; and internet providers whose networks carry proxy traffic.

Questions and Answers