Your office TV, the screen in your waiting room, the digital sign in your shop window. What if the malware was already inside them before you ever switched them on?
That is exactly what Google says happened. On November 2, 2026, Google announced it had disrupted XCPE, a botnet built from more than 1.3 million Android devices — most of them Android TV set-top boxes. The backdoor was not downloaded by a careless employee and it was not smuggled in through a phishing email. According to Google’s Threat Intelligence Group, it was built into the devices’ firmware by the manufacturer itself, and it ran with full system privileges from the day the box left the factory.
This is not a story about someone else’s living room. If your business uses Android TV boxes, smart displays, digital signage, or any cheap Android-powered screen, this takedown is a warning with your name on it. The control servers are down. The backdoor is not.
1. What Google Actually Announced on November 2
Google published its report on November 2, 2026, and the scale is hard to overstate. The XCPE botnet enrolled more than 1.3 million Android devices. The overwhelming majority were Android TV set-top boxes, but Google also found the backdoor in other Android-based hardware, including telehealth devices, karaoke machines, and digital signage displays. The botnet spanned roughly 200 countries.
Google says it assesses with high confidence that the backdoor was developed and operated deliberately, for financial gain, by Videostrong Technology Co., a Shenzhen-based manufacturer of Android devices. Videostrong builds set-top boxes both under its own MECOOL brand and as an original equipment and original design manufacturer for other labels, so the infected hardware reached buyers under many different brand names, over several years.
The disruption itself was a joint operation. Google took legal action to take down the domains and servers Videostrong used to control the botnet and push malware modules, plus a separate legal action against the command-and-control domains behind more than a dozen additional malware families that were loaded through the backdoor. Partners in the operation included Japan’s National Police Agency, Lumen’s Black Lotus Labs, HUMAN Security, Plume, Synthient, TrendAI, and the Motion Picture Association.
Google also banned Videostrong — along with any future subsidiaries and affiliates — from building or selling certified Android devices, or from supplying software to other certified vendors. And Google estimates that the wider takedowns will cut criminal access to at least 10 million additional compromised devices beyond XCPE’s own 1.3 million.
One important caveat, stated plainly: this is Google’s assessment, corroborated by partner security firms. It is not a court ruling. Videostrong did not respond to press inquiries about the claims, and as of November 2 its own website still described some products as “Google Certified” Android TV devices.
2. How a Botnet Shipped Inside the Box
The backdoor at the centre of XCPE is known as x.cpe — or com.oemservice in some builds. It was preloaded into the firmware partition of the devices, which gave it Android system privileges. That is the highest level of access on the device, above anything an ordinary app can reach.
That placement matters for three reasons. First, the backdoor was active from the first boot, before the buyer installed anything. Second, because it lived in firmware rather than in a downloaded app, ordinary antivirus scans and app removals would not find it. Third, security researchers say owners cannot remove the implant themselves — TrendAI counted 1,472,554 infected devices across 206 models, and the backdoor survives a factory reset in the usual sense, because the firmware itself is the infection.
Google tied the backdoor to Videostrong’s own YokaTV Player app and to a GitHub account that hosted payloads. The company then, according to Google, sold access to the infected boxes to criminal affiliates and loaded their malware modules onto the devices remotely.
This is the part that should change how you buy hardware. The threat did not come through your network. It came through your supplier.
3. What the Criminals Did With 1.3 Million Boxes
A botnet is only as valuable as what its operator can sell. In XCPE’s case, Google and its partners say the infected devices were used mainly for two things: advertising fraud and routing other people’s internet traffic through the owners’ home and office connections.
Ad fraud works like this: the backdoor loads hidden ads or fakes ad views and clicks on devices that nobody is watching, and the criminals collect the advertising revenue. Your box does the work, they get paid.
The second use is quieter and more dangerous for a business. Infected devices were turned into residential proxies — exit points that let strangers route their traffic through your internet connection, making it look as if it came from your office or shop. That traffic can include credential stuffing, scraping, spam, and worse, all wearing your IP address. If your network is ever flagged or blocked because of abuse you never committed, this is one way it happens.
The scale explains the economics. One compromised box is worthless. A million of them, always on, always connected, is an infrastructure business — and, according to Google, that is exactly what Videostrong was running.
4. Why the Takedown Does Not Mean Your Devices Are Clean
Here is the sentence every business owner needs to read twice: seizing a botnet’s control servers does not uninstall the code sitting on a million devices.
Google’s legal action cut the strings. The domains and servers that told the backdoor what to do are gone, and the command-and-control domains of the additional malware families were taken down too. But the x.cpe backdoor itself is still in the firmware of every infected box. If a new control server appears, or if the backdoor has fallback mechanisms, the devices can be reactivated.
TrendAI’s count — 1,472,554 infected devices across 206 models — makes the cleanup problem concrete. There is no patch a user can install to remove firmware-level code, and there is no central recall. The honest position, as of this week, is that the botnet is disrupted, not erased.
That distinction matters for your planning. “Google fixed it” is the wrong takeaway. “Google cut the control channel, and the infected hardware is still out there” is the right one.
5. The Business Risk Nobody Talks About: Your Screens Are on Your Network
Most small businesses do not think of a TV as an IT asset. But an Android TV box in your office is a computer on your network, with an internet connection, a processor, and — in XCPE’s case — system-level code you did not choose.
Think about where these devices actually live in a small business. The TV in the reception area playing a slideshow. The screen in the waiting room. The digital menu board in a café or restaurant. The cheap streaming box in a meeting room. The signage display in a shop window. Many of these were bought online for the lowest price, plugged into the same Wi-Fi as your laptops, your point-of-sale system, and your customer data, and then forgotten.
That is the real exposure. A compromised device on your main network can see traffic, hog bandwidth, and serve as a launchpad for further attacks inside your network. Even if the XCPE backdoor never touches your business directly, the pattern is now proven: bargain Android hardware can arrive pre-compromised, and nobody in your office will notice, because a TV box does not behave suspiciously. It just plays video.
This is a different event from the other security stories on this blog. The October 30 Binance hack was a crypto exchange breach, and the October 21 PHP2Shell story was a software vulnerability in website code. XCPE is a hardware supply-chain compromise — the infection was baked in at the factory.
6. 7 Checks to Run This Week
You do not need a security team to do this. You need an afternoon, a list, and a willingness to unplug things.
- Inventory every Android-powered screen and box. Walk the office, the shop floor, the waiting room. Write down every Android TV box, smart TV stick, digital sign, and display. If you do not know what is on your network, you cannot protect it.
- Check the brand and the seller. If a box came from an unknown brand, a marketplace listing with no real company behind it, or a suspiciously cheap bundle, treat it as untrusted. XCPE spread through budget boxes sold under many labels — the brand on the box is not a reliable guide.
- Move screens off your main network. Put TVs, signage, and streaming boxes on a separate guest network or VLAN, away from your laptops, point-of-sale terminals, and anything holding customer data. This single step limits what any compromised device can reach.
- Look for unexplained traffic. A TV box should use bandwidth when someone is watching. Sustained uploads at 3 a.m., traffic to unknown domains, or a device that is always busy when nobody is using it are red flags. Your router’s device list and traffic stats are the place to look.
- Update firmware — and accept its limits. Install any firmware update the manufacturer offers. But be honest with yourself: a firmware update from the same supply chain that shipped the backdoor is not a guarantee, and for XCPE devices there is no user-installable removal.
- Retire what you cannot verify. If a box is uncertified, unbranded, or from a manufacturer you cannot trace, the cheapest fix is replacement with a certified device from a known brand. A $30 box is not a bargain if it rents out your internet connection to criminals.
- Buy certified, from now on. For any future purchase, buy Google-certified Android TV devices from established brands, through reputable retailers. Check the certification, keep the receipt, and record the model. Procurement is now a security control.
7. What to Do If You Already Own a Cheap Android TV Box
First, do not panic — and do not assume every cheap box is infected. XCPE affected specific firmware from one manufacturer’s supply chain, not every budget device ever sold. But “probably fine” is not a security posture, so work through it methodically.
Unplug the box from your main network and move it to an isolated guest network, or disconnect it entirely until you have checked it. Look up the exact model and brand online, alongside the words “XCPE” and “x.cpe”, and see whether researchers have named it among the affected models. Check whether the manufacturer has published any statement or update. If the model appears on an affected list, or if you cannot identify the manufacturer at all, replace the device rather than trying to clean it — researchers are clear that owners cannot remove this implant themselves.
If the box is used for anything involving customer data, payments, or logins — and it should never be — move that activity off it immediately. And if you bought several identical boxes for multiple locations, check all of them: supply-chain infections arrive in batches.
Keep the old device’s details — brand, model, seller, purchase date — in a note. If a recall, refund programme, or official guidance follows, you will want that record.
8. The Bigger Lesson: Your Supply Chain Is Now a Security Decision
XCPE is not the first time this has happened, and that is the point. Google’s earlier legal action against BadBox 2.0 involved more than 10 million uncertified Android devices infected in a similar way. The pattern is now established: criminals do not always need to hack you. Sometimes they just need to be the factory.
For a small business, the lesson is practical, not theoretical. Security used to be about passwords and phishing training. Now it includes a question most owners never asked: who actually made the hardware on my network, and what did they put in it before I bought it?
The fix is not expensive. It is a buying rule: certified devices, known brands, reputable sellers, separate network for screens and smart devices, and a written inventory of everything connected. That is a one-page policy, and it would have stopped XCPE from ever reaching your network.
The businesses that get hurt by the next supply-chain compromise will not be the ones with the weakest passwords. They will be the ones that bought the cheapest box and plugged it into the same network as everything else.
The Bottom Line
Google’s XCPE takedown is genuinely good news — 1.3 million hijacked devices cut off from their controllers, a manufacturer banned from the certified Android ecosystem, and at least 10 million more devices shielded by the wider action. But the backdoor is still sitting in the firmware of those boxes, and the market that paid for it is still there.
So take the win, and then take the afternoon. Inventory your screens, isolate them from your main network, and replace anything you cannot verify. The next XCPE will not announce itself with a press release. It will arrive in a brown box, at a price that looks too good to pass up.
If you are not sure what is on your network — or you would like a professional review of your website, your devices, and your setup — book a free consultation and we will go through it with you.
Sources: Google Threat Intelligence Group report on the XCPE disruption (November 2, 2026), via Cyber Security News, Brandefense, Breach News, PBX Science, and SQ Magazine; Google Trends Explore, United States, “android botnet” — “google android botnet takedown” Breakout, interest peaking at 100 on November 3, 2026. Attribution note: the claim that Videostrong deliberately built and operated the backdoor is Google’s assessment, stated with high confidence and corroborated by partner firms; it is not a court ruling, and Videostrong did not respond to press inquiries.