Millions of Android TV boxes removed from botnet
Google and partners say they have dismantled a botnet that was running unnoticed on more than 1.3 million devices.
Listen to this article
There is no audio version yet. Request one and an AI voice will read the article aloud.
Read by an AI voice.
Google and technology companies say they have dismantled a botnet hidden in the software of more than 1.3 million Android set-top boxes. According to the researchers, the devices had already been infected before reaching users.
The operation targeted the so-called XCPE botnet. Google says the infrastructure was disrupted last week together with partners and that command-and-control domains were taken offline. Trend Micro confirms that the collaboration concerned more than 1.3 million set-top boxes in more than 200 countries.
According to Google, the malicious software was embedded in the firmware: the basic software that enables a device to function. This meant users did not have to open a suspicious attachment or install an app. The researchers write that the infected devices were used, among other things, for advertising fraud, proxy traffic and installing additional malware.
The devices generally continued to work normally. That makes this type of attack difficult to detect. Meanwhile, households’ internet connections and IP addresses could be used to relay third-party traffic. Device, network and account data were also allegedly collected, the researchers say.
Google places responsibility, with a high degree of confidence, on Videostrong Technology, a manufacturer and designer of Android devices. The company is said to have developed the backdoor and sold access to infected devices to criminal partners. This is Google’s assessment; the public announcement contains no response from Videostrong.
The partners say that the dismantling does not automatically mean that every infected device is clean. According to Google, the campaign mainly disrupts the infrastructure used to control the botnet. Google says that even a device displaying a normal picture may be misused in the background. Google says it has adjusted its device review process and excluded the manufacturer in question from new devices with Google apps pre-installed.
Also show the region and a close-up
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The key facts were checked directly against announcements by Google and Trend Micro dated 2 November 2026. Where the sources provide an estimate, the text presents it as Google’s assessment.
- confirmed The XCPE botnet was present on more than 1.3 million set-top boxes. — Google mentions more than 1.3 million; Trend Micro gives the same figure. source
- confirmed The devices were infected in the firmware before sale. — Trend Micro describes pre-embedded firmware as the route of infection. source
- confirmed The botnet was used for advertising fraud and proxy traffic. — Both sources mention advertising fraud and residential proxies. source
- uncertain Videostrong developed and exploited the backdoor. — This is Google’s assessment and not an independently established judicial fact. source
Editor's note
The scale and the dismantling come from statements by Google and its partners. The attribution to Videostrong is Google’s assessment; no response from the company is available.Sources
- Shutting the Door on the XCPE Botnet — Google Threat Intelligence
- Industry Takedown of Botnet Hidden in More Than 1.3 Million TV Set-Top Boxes — Trend Micro
More on this in Dutch media
- Tweakers — „android botnet”
- AD — „android botnet”
- RTL Nieuws — „android botnet”