Google says partners cut off command servers for a 1.3 million-device Android TV botnet.
Why it matters: The operation shows how inexpensive connected devices can be repurposed for advertising fraud, residential proxy services and malware distribution. The disruption blocked central control but did not remove the malware from infected devices.
- Google said the XCPE botnet enrolled more than 1.3 million Android TV set-top boxes.
- Google assessed with high confidence that Videostrong developed, deployed and operated the backdoor for financial gain.
- TrendAI said an advertising-fraud module was scheduled on approximately 1.33 million devices, a separate figure from Google’s enrollment count.
- Google said affiliate infrastructure could include at least 10 million additional compromised devices.
Google and industry partners said they disrupted the XCPE backdoor and botnet in late October 2026 after it enrolled more than 1.3 million Android TV set-top boxes, according to Google Threat Intelligence. The disruption cut off central command infrastructure. It did not remove the malware from devices already sold.
Google assessed with high confidence that Videostrong Technology Co., an Android device manufacturer and design supplier, intentionally developed, deployed and operated the backdoor for financial gain. Google said the company allegedly sold criminal affiliates access to infected devices. That is Google’s assessment, not an established finding in the materials provided.
The malware was built into device software with system-level access. If users removed it, the implant could restore itself after a reboot. It could install apps silently, run commands, capture screens, record keystrokes, inspect networks and extract data.
The operation also turned home internet connections into residential proxy infrastructure. Components were linked to Linkfog, AppSalt, NetNut and Traffmonetizer. TrendAI reported that an advertising-fraud module was scheduled on approximately 1.33 million devices. That figure measures scheduled fraud activity, while Google’s 1.3 million figure measures enrolled devices; the counts therefore are not directly interchangeable. TrendAI also reported silent-install commands reaching more than 187,000 devices by download count.
The infection appeared on telehealth devices, karaoke machines and digital-signage systems. Google said it took legal action against the control infrastructure, but the materials do not identify a court, filing or specific legal remedy. Google also barred Videostrong, its future subsidiaries and affiliates from building or selling certified Android devices or supplying software to certified vendors.
Google said affiliates’ separate infrastructure could include at least 10 million additional compromised devices. TrendAI said the firmware implant remained on infected boxes after the disruption.
By the numbers
- 1.3 million - Android TV devices Google said the XCPE botnet enrolled
- 1.33 million - Devices TrendAI said were scheduled for advertising fraud
- 10 million - Additional devices Google said affiliate infrastructure could reach
Yes, but: Cutting off command infrastructure can limit the botnet’s activity, but it does not remove the firmware implant. The materials also do not identify a court or filing for Google’s legal action.