On November 2, 2026, Google announced the Google Android botnet takedown: its Threat Intelligence Group had disrupted XCPE, a hidden botnet running on more than 1.3 million devices, most of them cheap Android TV set-top boxes. Nobody had hacked these boxes after purchase. The maker had built the backdoor into the firmware before the devices ever reached a shop shelf.
Google says the Shenzhen device maker Videostrong installed the backdoor on purpose, then sold access to criminal affiliates, who used the boxes as residential proxies and for ad fraud. This article explains what XCPE is, how it slipped past Google’s own safety tests, who is affected, and what owners and businesses should do now that the control network is down but the backdoor itself is still sitting on every affected device.
What Happened in the Google Android Botnet Takedown?
Google’s Threat Intelligence Group described the operation in a Google Cloud blog post titled “Shutting the Door on the XCPE Botnet.” The disruption itself happened in late October 2026, after investigators traced the botnet’s control systems and the companies behind them. As The Hacker News reported, Google paired the technical work with legal action, and courts let it seize the control domains and servers that ran XCPE, along with the control domains of the more than 12 affiliate malware families that rented space on the infected boxes.
Google did not act alone. The partner list included Japan’s National Police Agency and the security firms Lumen, HUMAN Security, Plume, Synthient and TrendAI, as Infosecurity Magazine covered in its report on the operation. Each partner brought a different view of the same network, from internet traffic records to device level telemetry collected inside real homes and offices.
The consequences for the maker went beyond the seizure. Google banned Videostrong, and any future subsidiaries or affiliates of the company, from building or selling certified Android devices. It also barred the company from supplying software to other certified makers, and it cut all business ties with the firm. A maker that Google once approved now cannot take part in the certified Android market at all.
What Is XCPE, and How Did the Backdoor Work?
The backdoor is a piece of software called x.cpe, which also appears on devices under the name com.oemservice. Videostrong, an original equipment and design manufacturer based in Shenzhen, preinstalled it in device firmware. The company builds MECOOL branded boxes and also manufactures boxes that other brands sell under their own names, so its firmware reached far more living rooms than its own brand suggests. Once a box starts up, x.cpe runs as a system app with system level privileges, the deepest level of control Android gives any software.
That level of access lets the backdoor switch off Google Play Protect checks, the built in scans that normally warn users about harmful apps. With the checks off, x.cpe can install further apps silently, without the owner seeing a prompt or a permission screen. Researchers who examined infected devices saw the backdoor and its add on modules do all of the following:
- Install new apps and run commands sent from remote servers
- Capture screenshots and record keystrokes typed on the device
- Copy account details, device information, app lists and system logs
- Open reverse shells, which give a remote operator a live path into the device
Restarting the box does not help. The backdoor keeps a copy of itself in the /oem partition and reinstalls from there on every reboot, so it survives the one fix most owners try first.
Videostrong did not keep the network to itself. Google says the company sold access to criminal affiliates, who loaded more than 12 malware families onto the boxes. Most modules turned each box into a residential proxy, which means strangers rented the home’s internet connection and bandwidth through services such as Honeygain and NetNut, so their traffic looked like ordinary household traffic. Other modules ran ad fraud, stole data or pulled down still more malware.
Google assesses with high confidence that Videostrong intentionally built and ran the backdoor for financial gain, and the evidence it published is unusually direct. A GitHub account named yf-videostrong hosted the backdoor packages. A document signed by Videostrong’s own research and development director sat in an open folder on one of the botnet’s servers. And a domain belonging to Videostrong shared an IP address with the botnet’s control panel, tying the company’s own infrastructure to the operation.
How Did the Maker Hide It from Google’s Own Tests?
The trick was timing. The backdoor stayed dormant while Google ran its certification tests on Videostrong’s devices, so the units reviewers examined behaved like clean, ordinary streaming boxes. Only after a customer bought the device and booted it up at home did x.cpe load its malicious code and join the botnet. A test process that checks a device before sale cannot see behavior that only starts after the sale.
That distinction makes XCPE a first. Google says this is the first documented case of a certified Android maker deliberately embedding a botnet in its own products. Earlier Android botnets spread through uncertified hardware that had never passed any review. This one wore the certification badge. Google has since changed its review process and tightened its firmware checks, so dormant components face deeper scrutiny before a maker wins approval.
Who Is Affected?
The numbers are large. TrendAI counted 1,472,554 infected devices across 206 models between June 3 and October 1, spread across more than 200 countries, as SecurityWeek reported in its coverage of the takedown. The biggest clusters sat in Malaysia, Brazil, Iraq, Mexico and Taiwan. The United States, Germany, the United Kingdom, Australia and Canada each had roughly 26,000 to 42,000 infected devices, so this is not a problem that stayed in one region or one market.
| At a glance | Details |
|---|---|
| Botnet | XCPE, controlled through the x.cpe backdoor |
| Devices | More than 1.3 million (TrendAI counted 1,472,554) |
| Maker | Videostrong Technology, based in Shenzhen |
| Main devices | Android TV set-top boxes across 206 models |
| Used for | Residential proxies, ad fraud and data theft |
| Status | Control network seized in late October 2026, maker banned by Google |
| Fix | None for owners, the backdoor itself cannot be removed |
Most infected hardware is Android TV boxes, but not all of it sits in living rooms. Investigators also found the backdoor on telehealth devices, karaoke machines and digital signage, the kind of equipment that runs quietly in clinics, shops and public spaces. Synthient published a list of 182 device model names linked to the campaign. A model name appearing on that list does not by itself confirm that a specific device is infected, but it tells owners and IT teams where to look first.
Why Owners Cannot Simply Delete It
The takedown destroyed the botnet’s command network, not the backdoor. x.cpe still sits inside the firmware of every affected device, waiting for instructions that, for now, have nowhere to come from. Owners cannot uninstall it, because Videostrong signed the backdoor with the maker’s own key. Android treats software signed that way as a trusted part of the device itself, so the system gives the owner no supported way to remove it.
The workarounds only go so far. Plume, one of the takedown partners, suggests a factory reset may clear the extra modules that affiliates loaded onto a box, but the reset may not remove x.cpe itself, since the backdoor restores from a protected partition. Synthient’s advice to owners is blunt: discard affected boxes and replace them with hardware from a maker you can verify.
What Owners and Businesses Should Do Now
For a homeowner, the steps are short. Check your box’s model name against Synthient’s published list of 182 models. If your model appears on it, unplug the box and replace it. Do not rely on a factory reset to make it safe, and do not hand it to someone else to use. A box that rented out your connection once can do it again the moment a new control server appears.
For organizations, the risk looks different, and bigger. Cheap Android boxes and similar smart hardware run in waiting rooms, clinics, retail stores, hotels and staff kitchens, usually plugged into the same network as the systems that hold real company data. Nobody in IT approved them, nobody patches them, and nobody would notice if one started sending traffic to a criminal proxy service. Advice from Synthient and TrendAI points to the same checklist:
- Hunt for MECOOL boxes and similar unmanaged devices on the network, then disconnect and replace any you find
- Block the published XCPE control domains and IP addresses at the firewall
- Keep smart TVs, signage and other IoT devices on separate network segments, away from systems that hold company data
- Treat the home devices of remote staff as part of the attack surface, and keep corporate access behind managed devices only
The lesson underneath XCPE is simple: the cheapest unmanaged device on a network sets the real security level for everything connected to it. Closing that gap takes an inventory of what is plugged in, clear ownership of each device, and a habit of treating screens and sensors with the same care as servers. Organizations that run their work on managed, secure AI and device systems start from that position by default, because a system nobody manages is a door nobody watches.
What Happens Next
The immediate fight is over. The control domains and servers are seized, the affiliate networks lost their base, and Google expects the wider legal action to sever criminal access to at least 10 million additional devices beyond the XCPE count. The ban also follows Videostrong forward, covering future subsidiaries and affiliates, so the company cannot simply reopen under a new name and sell certified boxes again.
The case will be measured against an earlier one. In July 2025, Google sued over BadBox 2.0, a botnet that infected more than 10 million devices. Those devices were uncertified, built outside Google’s review process entirely. XCPE is different and, for the industry, worse: these devices passed certification with the botnet already inside. Expect Google’s tighter firmware checks to shape how every Android TV maker is reviewed from here, and expect buyers to ask harder questions about who actually built the box behind a familiar brand name.
What does not change is the hardware already in homes and businesses. More than a million devices still carry a backdoor that only their maker can sign away, and their maker is now banned and cut off. For those boxes, replacement is not the cautious option. It is the only one.
Conclusion
The Google Android botnet takedown closed one of the strangest security stories of the year: a certified device maker shipping the botnet inside its own products, then renting the infected boxes to criminals. Google and its partners killed the control network, and the maker faces a permanent ban from certified Android. But the backdoor outlives the headlines because it lives in firmware that owners cannot touch. If you own a box on Synthient’s list, replace it. If you run a network, go and count the unmanaged screens on it, because XCPE proved that attackers already have.
Frequently Asked Questions
What is the XCPE botnet?
The XCPE botnet is a network of more than 1.3 million infected Android devices, most of them TV set-top boxes, controlled through a backdoor called x.cpe. The maker, Videostrong, preinstalled the backdoor in the firmware and, Google says, sold access to criminal affiliates, who used the boxes as residential proxies and for ad fraud. Google disrupted the botnet’s control network in late October 2026.
How do I know if my Android TV box is infected?
There is no simple test on the box itself, because x.cpe hides and switches off Google Play Protect checks. Start with the list of 182 device model names that Synthient published, and check your box’s model against it. A model name on the list does not confirm infection on its own, and boxes built by Videostrong, including MECOOL branded devices, carry the most risk.
Can the XCPE backdoor be removed?
No. Owners cannot remove x.cpe, because it sits in the firmware and is signed with the maker’s key, so the device treats it as a trusted part of the system. A factory reset may clear extra modules that affiliates added, but it may not remove x.cpe itself. Security firm Synthient advises owners to discard affected boxes and replace them.
Image credits: Living room TV photo by JESHOOTS.com via Pexels (pexels.com/photo/1201996). TV remote close-up by Image Hunter via Pexels (pexels.com/photo/21792098). Network switch photo by Vladimir Srajber via Pexels (pexels.com/photo/13963756). Tangled network cabling photo by Paul Seling via Pexels (pexels.com/photo/12266914). All photos are used under the Pexels License, which allows free use; credit is given voluntarily. The three infographics are original works created for SoftBrixAI, with data from Google Threat Intelligence, TrendAI and Synthient as reported in the sources linked in the article.
