Google dismantles the XCPE botnet hidden in 1.3 million Android TV boxes, and what it means for your business devices

Google and its security partners have disrupted the XCPE botnet, a network of more than 1.3 million Android TV streaming boxes whose backdoor was built into the device firmware at the factory, in an action reported on 2 November 2026. The takedown of related command servers cut off at least 10 million more devices. For a business, the lesson is simple: a cheap connected device can arrive already compromised, so it belongs on your security list, not in a blind spot.

What was reported

According to BleepingComputer:

• Scale: more than 1.3 million Android TV streaming boxes were in the XCPE botnet, and taking down command servers used by related malware families cut off at least 10 million more devices.
• Other devices: the wider set included retail set-top boxes, karaoke machines and telehealth hardware, and Google says not all of them are Android devices.
• What it did: operators sold access to affiliates who used the boxes as residential proxies, routing other people's traffic through them without consent, and for advertising fraud. Attackers could also silently install apps, disable Google Play Protect, run commands, take screenshots and inject keystrokes.
• The maker: Google says Videostrong Technology, a Chinese device maker, intentionally infected the devices, with the backdoor built into the firmware during manufacturing.
• Google's action: it took down the command servers, ended its relationship with Videostrong, revoked its licence to make certified Android devices, banned it and its future affiliates from producing certified Android devices, and changed its certification review process.
• Partners: Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI.

SecurityWeek and The Record carried the same figure of more than 1.3 million devices, with The Record reporting the boxes reached over 200 countries.

Why this one is different

Most device botnets get in through a security hole or a user installing something bad. BleepingComputer reports XCPE was different: it was built into the firmware during manufacturing, so a box could arrive compromised out of the box. It also reports the malware reinstalls itself from a firmware partition, so it is not removed by normal means. That is why a certification badge matters, and why Google revoking Videostrong's licence is the real action here.

What it means for businesses

Plenty of businesses run cheap connected devices without thinking of them as computers: an Android TV box showing a menu board, a digital signage screen, a karaoke machine in a cafe, a no-name streaming stick in a waiting room. Each one is on your network.

• Treat connected devices as part of your network. A compromised box can route strangers' traffic through your connection and your IP address, which can get your business blocklisted or worse.
• Buy from known makers. Before buying a connected device, check it against Google's certified-partner list. A low price from an unknown brand is not a bargain if it ships with a backdoor.
• Separate them. Where you can, keep TV boxes, signage and cameras on a guest or separate network, away from the computers that hold your business data.
• Know what is connected. Most small businesses cannot name every device on their network. A simple inventory is the first step, and it is the kind of thing an IT support provider should maintain for you.
• The same thinking applies to cameras. Internet-connected CCTV has the same risk if it comes from an unknown maker. See our note on securing devices in AI agent security basics for a small business.

This is not a reason to panic about every screen in the office. It is a reason to keep a list of what is connected and to buy connected hardware the way you would buy a work PC: from a maker you can name.

We help businesses keep track of and secure their devices through our IT support service and CCTV and security systems. Tell us what is connected in your business and we will help you work out what to check first.