SecurityEndpoints & devicesNote
Google bans TV-box maker Videostrong, which it says backdoored 1.3 million boxes
What Google’s 3 November account of the XCPE takedown says: the backdoor, who Google says built it, what the boxes were made to do, and what certification tells a buyer.
Google says the backdoor in more than 1.3 million Android TV set-top boxes was built and run by an Android device maker. On 3 November its Threat Intelligence Group wrote that, the week before, Google and partners had dismantled the XCPE backdoor, and that it assesses “with high confidence” that the backdoor and botnet were “intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.”, an Android manufacturer and design house. Google has cut ties with Videostrong and banned it, and “any future subsidiaries or affiliates”, from building certified Android devices or supplying software to certified vendors.1
Google also took legal action to take down the domains and servers that controlled the botnet, and the command servers of more than a dozen malware families loaded through it. Because those affiliates spread their code by other routes too, Google assesses that the takedown “will sever access to at least 10 million additional compromised devices”. It names its partners as Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI.1
01What Google says the boxes were built to do
By Google’s account the backdoor, x.cpe, sits in the firmware at system privilege and reinstalls itself on reboot if removed. From late 2024 it passed commands to a separate loader that installs modules written by other firms, which buy the access. Videostrong “employed obfuscation techniques to exploit a gap in our tests and load malicious code after the device’s first boot”, Google writes; it has changed its review process since.1
The backdoor ships in the firmware, then rents the boxes to other firms as proxy and ad-fraud capacity
How XCPE worked, as Google Threat Intelligence Group describes it, from late 2024 to its takedown in late October 2026
- 01
Built in at the factory
x.cpe is preloaded in the firmware with system privilege; uninstalled, it returns on reboot. - 02
Phones home
An HTTP check-in, then a standing MQTT link for commands. It switches off Play Protect’s app checks. - 03
Loads affiliates’ code
A loader, and since August 2026 single-purpose droppers, install modules other firms wrote. - 04
Sold as traffic
Residential proxy exit nodes (Linkfog, AppSalt, NetNut), ad fraud (HiddenView, CBOXTV), and more backdoors.
Source: Google Threat Intelligence Group, Shutting the Door on the XCPE Botnet · as of 3 November 2026 · Module names are Google's examples, not a full list.
Operators also captured live screenshots, injected keystrokes, took account and device data and opened reverse shells, Google says. Most infected devices are set-top boxes, but it also found telehealth devices, karaoke machines and digital signage.1
02Why a living-room box is an office problem
Residential proxy networks sell the ability to route traffic through IP addresses that internet providers own, Google explains. In one week of June 2026, Google counted 316 distinct threat clusters, including cybercriminal and espionage groups, using suspected exit nodes of NetNut, one of the proxy networks XCPE loaded. Such nodes let attackers mask where they come from and run password-spray attacks, and reach other devices on the same network, Google said.3 In July 2025 Google sued the operators of BadBox 2.0, which had compromised over 10 million uncertified devices.4
Sources
- Google Threat Intelligence Group, Shutting the Door on the XCPE Botnet (including indicators of compromise) — 3 November 2026
- Google Play Help, Check & fix Play Protect certification status — undated help page
- Google Threat Intelligence Group, Google's Continued Disruption of Malicious Residential Proxy Networks (NetNut) — 3 July 2026
- Google, We're taking legal action against the BadBox 2.0 botnet — 17 July 2025
- Videostrong Technology, company website (product list) — undated page
- Android, Play Protect certified partners — undated page
- CERT-In, Directions under section 70B(6) of the IT Act, 2000 (direction (ii) and Annexure I: six-hour reporting) — 28 April 2022
Related on TechBag: the Esper page, for Android devices dedicated to one job, and the secure web and DNS guide.
Disclosure. TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.
Keep reading
