Google Dismantles Massive XCPE Botnet Embedded in Android TV Firmware
Manufacturer Videostrong deliberately infected over 1.3 million devices to facilitate global cybercrime operations.
1Systemic Firmware Infection
Google and global security partners dismantled the XCPE botnet, which compromised over 1.3 million Android TV boxes. The backdoor was pre-installed in firmware by Shenzhen-based manufacturer Videostrong. This operation was not a security oversight but an intentional, profit-driven scheme to sell device access to various criminal affiliates worldwide.
2Monetizing Home Networks
The primary goal of the XCPE botnet was to turn consumer devices into residential proxy servers. By hijacking home internet connections, criminals could anonymize their malicious traffic. This allowed them to conduct ad fraud, scrape data, and bypass security filters while appearing as legitimate traffic from unsuspecting residential households.
3Deep System Privileges
The x.cpe backdoor operated with system-level privileges, granting attackers total control over infected hardware. It could silently install applications, capture screenshots, record keystrokes, and map local networks. By disabling Google Play Protect, the malware ensured it could execute malicious commands and maintain persistence without triggering standard security alerts for users.
4Persistence and Evasion
The malware was designed to survive standard user attempts at removal. Because it resided in a protected firmware partition, it automatically reinstalled itself upon every device reboot. Videostrong successfully bypassed Google’s security tests by using code obfuscation and delaying the execution of malicious payloads until after the initial device boot.
5Global Impact Scope
TrendAI identified over 1.47 million infected devices across 206 models between June and October. While set-top boxes were the primary target, the infection also affected telehealth equipment, karaoke machines, and digital signage. Significant infection clusters were reported in Malaysia, Brazil, Iraq, Mexico, Taiwan, and several Western nations.
6Command and Control
The botnet utilized a lightweight MQTT messaging protocol to receive remote instructions from operators. Files and additional malware modules were frequently hosted on GitHub releases or operator-controlled servers. This infrastructure allowed for dynamic updates, enabling criminals to push new malicious scripts or change configurations on infected devices in real-time.
7Severing Criminal Ties
Google has officially severed all business ties with Videostrong, banning the company from producing certified Android devices. This prohibition extends to all future subsidiaries and partners. Furthermore, Google took legal action to seize control domains, effectively disrupting the infrastructure used by over a dozen distinct malware families linked to the botnet.
8Wider Ecosystem Disruption
The takedown extends beyond the 1.3 million XCPE-infected boxes. Because the criminal affiliates involved used the same infrastructure for other campaigns, Google estimates this action will sever access to at least 10 million additional compromised systems. This highlights the interconnected nature of modern IoT botnet operations and their shared backend resources.
9Consumer Risk Reality
Security researchers warn that a simple factory reset may not fully eradicate the x.cpe backdoor. Because the malware is signed with the manufacturer’s key and embedded in the firmware, experts suggest that replacing the hardware is the only reliable way to ensure security. Users should treat these devices as permanent risks.
10Corporate Security Warning
TrendAI advises companies to treat unmanaged consumer IoT devices on home networks as part of their corporate attack surface. As remote work becomes standard, these compromised TV boxes can serve as entry points for network mapping. Organizations should ensure corporate access remains strictly behind managed, secure devices to prevent lateral movement.
11Historical Context
This operation is part of a broader ecosystem of IoT exploitation, similar to the BadBox 2.0 botnet disrupted in March 2025. These campaigns demonstrate a recurring pattern where hardware manufacturers intentionally compromise firmware to monetize user bandwidth. Such actions represent a fundamental breach of trust in the global supply chain.
12Future Security Outlook
In response to the XCPE incident, Google is tightening its firmware integrity checks and manufacturer vetting processes. The incident underscores the difficulty of securing fragmented IoT ecosystems where manufacturers may act as malicious actors. Moving forward, users and enterprises must remain vigilant regarding the provenance of low-cost, connected consumer hardware.