Android TV box botnet operators used more than 1.3 million infected set top boxes worldwide as residential proxies, Google said on Nov. 2, 2026.
Google’s Threat Analysis Group said it worked with Japan’s National Police Agency and multiple cybersecurity firms to dismantle the XCPE botnet’s control infrastructure, and that most affected devices were Android TV set top boxes manufactured by Shenzhen device maker Videostrong.
Android TV box botnet: backdoor activated at boot
Google said the backdoor components were written into device firmware before units left the factory, appearing in different versions as files named x.cpe or com.oemservice. Once a user connects the box to the internet, the program can use system privileges to receive remote commands, install apps in the background, capture screen images, and simulate key presses. Google added the code could disable Google Play Protect’s app verification.
Home broadband used as residential proxies
Google said criminal partners who obtained access could turn infected boxes into residential proxy nodes, letting third parties borrow a household’s IP address and bandwidth. To outside websites, that traffic appeared to come from ordinary homes. Separate modules could open webpages in the background to generate fake ad impressions or clicks, letting operators earn money while the boxes continued to play video for users.
Security firm TrendAI reported that between June and October 2026 it observed 1,472,554 infected devices across 206 models in more than 170 countries. The participating organizations used slightly different observation windows and coverage, and the joint announcement adopted the rounded figure of “more than 1.3 million” infected boxes, Google said.
Google said the joint action also disrupted domains used by more than a dozen malware families. Because the malicious software used additional propagation methods, Google estimated the takedown could further cut criminal access to at least 10 million infected devices globally.
Manufacturer access and certification concerns
Google said it has high confidence that Shenzhen manufacturer Videostrong deliberately embedded and operated the backdoor and then sold access to criminal partners. According to Google, the company used code obfuscation to evade original certification tests and only loaded the malicious code after a device’s first boot.
Google said it has ended cooperation with Videostrong and has banned the company and its current or future affiliates from manufacturing and selling Google certified Android devices or from supplying software to other certified manufacturers. Google also said it has changed its review procedures to detect the obfuscation technique.
Backdoor can persist after cleanup
Google warned that control infrastructure being taken down does not remove backdoors from already sold devices. The company said that even if the installed x.cpe component is removed, the box may reinstall the backdoor from firmware stored in the /oem/ partition at restart. Google said there is no conclusive evidence that a factory reset removes the backdoor.
Security firm Synthient recommended that users immediately disconnect suspicious boxes from Wi Fi or unplug their network cable, and that confirmed infected devices be taken out of service and replaced. Synthient also advised placing other smart home devices on a separate network from computers that hold sensitive data.
For consumers worried about exposure, Google suggested checking device model numbers against public advisory lists from Google and partner firms, and applying any available firmware updates from a device maker. TrendAI and other security researchers continue to publish indicators of compromise and mitigation steps, Google said.