Google Dismantles XCPE, a Botnet Hidden in Android TV Firmware
Google said on November 2, 2026 that it has dismantled a backdoor that one of its Android manufacturing partners secretly built into 1.3 million devices, turning them into a botnet. The backdoor and the botnet it enabled are known as XCPE, also written as x.cpe. Google said it has cut ties with the manufacturer, Shenzhen-based Videostrong Technology Co.
Videostrong has been banned from building or selling certified Android devices and from supplying software for them, according to The Verge. Google said the infected devices were used for malicious activity without their owners' knowledge, including ad fraud, data exfiltration and routing unauthorized network traffic.
Google assessed that the backdoor and botnet were intentionally developed, deployed and operated for financial gain. In its threat intelligence write-up, the company said Videostrong monetized the access by selling it to criminal affiliates. Those affiliates' malware modules were then loaded onto infected devices.
The backdoor was hidden in the firmware of Android TV set-top boxes, which accounted for most of the impacted hardware. The botnet also reached Android-based Internet of Things (IoT) devices, including telehealth devices, karaoke machines and digital signage displays. According to reporting on the disclosure, the malware was built directly into many device models and brands over multiple years. Videostrong used obfuscation, meaning code deliberately written to be hard to read, to load the malicious code after an owner first booted the hardware. The infection therefore began at the point of use, not on the factory line.
Google said it disrupted the command-and-control (C2) domains that operated the affiliate malware modules. The company assessed that taking those domains down will sever access to at least 10 million additional compromised devices. It worked with industry partners on the dismantling and has changed its review process for device manufacturers following the incident.
The takedown follows another disruption. In July 2026, Google disrupted the NetNut malicious residential proxy network, which was used to conceal and route malicious online activity. Google said that action protected more than 2 million hijacked consumer devices from cybercriminals. Both operations target the same underlying problem: consumer hardware that carries traffic and code on behalf of parties the owner never selected.
In my view, the most instructive detail is where the compromise sat in the supply chain. The code did not arrive through a phishing email or an app a user chose to install. It was in firmware that a Google Android partner had produced, and it activated on first boot in a living room or a clinic. Owners of set-top boxes, karaoke machines and signage screens have few practical ways to audit what runs on them, so the certification program is one of the few checkpoints left. Google's tighter manufacturer review addresses that gap most directly, though the company has not said what the revised process involves beyond the change itself.
The broader context here is that these devices are cheap, long-lived and rarely patched. A botnet built on them can persist for years, and the 10 million figure for affiliate domains shows how many unmanaged endpoints a single C2 layer can reach. Removing that infrastructure cuts the reach quickly, while removing the manufacturer addresses the source. Google has described both steps.
For operators of networks with consumer IoT or set-top hardware, the immediate questions are which device families sit on their networks, what outbound connections those devices make, and whether any of them connect to the disrupted domains. For the wider Android ecosystem, the open question is whether partner vetting can catch firmware-level abuse before devices ship.
