Google and Partners Disrupt XCPE Botnet Preinstalled on 1.3 Million Android TV Boxes

What happened

In November 2026, Google announced that it had worked with a group of security companies and Japan's National Police Agency to disrupt XCPE, a botnet assembled from more than 1.3 million Android TV set-top boxes around the world. According to a dev.to analysis citing Google's Threat Intelligence Group (GTIG), the botnet was linked to Videostrong Technology Co., an Android device manufacturer.

The striking part was not the scale but the infection route. No one had to click a phishing link or install a shady app: the malicious functionality was embedded in the products before they ever reached their owners.

How the hijacked boxes were used

Once an infected box went online, it contacted remote infrastructure and could pull down extra malicious modules. As the dev.to write-up recounts, GTIG identified four ways the operators monetised the fleet:

• Residential proxying: the devices' home connections and IP addresses were quietly offered to third parties, making traffic appear to come from ordinary households.
• Advertising fraud: the boxes took part in schemes that manufactured fraudulent advertising revenue.
• Malware distribution: compromised units could receive further payloads.
• Remote access: operators kept the ability to interact with infected devices.

Residential proxies are not inherently criminal — they have legitimate uses in regional testing and market research — but enrolment without the owner's consent turns a living-room gadget into rentable criminal infrastructure. An infected box could keep streaming normally while its bandwidth was resold, leaving no obvious symptom beyond unusual network usage.

A supply chain problem, not user error

Standard endpoint advice — patch promptly, run antivirus, be careful what you download — assumes the device starts clean. XCPE undercuts that assumption. The dev.to piece frames it as a supply chain failure: a manufacturer controls firmware compilation, pre-installed apps, signing and update mechanisms, bundled SDKs and certification, and malicious code introduced at any of those stages can outlive measures that assume a trustworthy baseline. Familiar Android branding is no guarantee if the underlying update path is compromised.

Beyond the living room

According to the dev.to write-up, Google's investigation also identified the same malware in other Android-based products, including telehealth equipment, karaoke machines and digital signage systems. That matters to organisations: an infected IoT device attached to a corporate or healthcare network becomes a foothold, and weak network segmentation makes the situation worse. The lesson is that IoT security belongs inside the broader network security strategy rather than being treated as an isolated endpoint problem.

The takedown

Google coordinated the operation with Plume, Trend Micro, Lumen, HUMAN Security, Synthient and Japan's National Police Agency. It took legal action against the domains and servers Videostrong used to control the malware and distribute new modules, and also went after command-and-control infrastructure run by criminal affiliates. By Google's assessment, cutting off these systems could sever the operators' access to at least 10 million additional compromised devices.

The write-up adds a caveat worth keeping: infrastructure takedowns uninstall nothing. Devices may still carry malicious components after their operators lose control, so disruption and endpoint remediation have to proceed together — and a factory reset should not be assumed to remove firmware- or system-level malware.

Practical takeaways

For individuals, the guidance is to buy from manufacturers with transparent security practices, research known issues with a model before purchasing, keep firmware updated, keep untrusted gadgets off networks that hold sensitive systems, and watch for unexpected bandwidth consumption. For organisations, the list includes maintaining an inventory of connected devices, segmenting networks to isolate untrusted hardware, monitoring outbound traffic, vetting vendors' firmware and update policies, and preparing incident-response procedures for compromised IoT hardware.

Why it matters

XCPE shows that the trust chain for connected hardware now runs all the way back to the factory floor. When malware ships pre-installed, the usual consumer defences largely fail, and a household's IP address quietly becomes a commodity. With 1.3 million boxes enrolled and Google estimating that the disruption cut off access to at least 10 million more devices, this ranks among the largest supply-chain IoT incidents on record — and a reminder that asking who built a device's firmware, and whether it can actually be updated, is now part of buying any connected device.