Google has dismantled an Android botnet that was built into the devices from the factory. Google Threat Intelligence Group's write-up, dated 3 November, says that "Google and industry partners dismantled the XCPE backdoor which enrolled more than 1.3 million set-top boxes into a botnet", and that the company assesses "with high confidence" that it was "intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.", a manufacturer of Android devices. If you searched for "google android botnet takedown", this is the event behind it.
This piece sets out what Google actually did and when, how the backdoor worked, where the coverage runs ahead of the sources, and what it means for a business with cheap streaming boxes, signage players or other connected gadgets plugged into its network.
What Google announced about the XCPE botnet
The core facts come from Google's own post. The XCPE backdoor sat in the firmware of the devices. Videostrong "monetized the backdoor by selling access to criminal affiliates and loading those affiliates' malware modules onto infected devices". Those modules were "conducting ad-fraud; silently enrolling infected devices into residential proxy networks; and loading additional malware".
Google lists four responses:
Legal action against the infrastructure. Google took "legal action to take down the domains and servers" behind the botnet, and against the command-and-control domains used by "over a dozen malware families" that rode on it.
A ban on the manufacturer. Google has "banned Videostrong and any future subsidiaries or affiliates from building and selling certified Android devices in the future, or supplying software to other certified vendors".
Changes to its own checks. Videostrong, Google says, "employed obfuscation techniques to exploit a gap in our tests and load malicious code after the device's first boot". Google says it has changed its review process and is improving how it checks firmware on certified Android TV devices. CyberScoop notes that Google did not share the specifics.
A wider cut-off. Because the affiliates also spread their modules by other routes, Google assesses that taking down their domains "will sever access to at least 10 million additional compromised devices".
The partners named are Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI. Most infected devices were Android TV set-top boxes, but Google also found infected "telehealth devices, karaoke machines, and digital signage devices". TrendAI, one of the partners, reported devices in more than 170 countries, with the most in Malaysia, Brazil, Iraq, Mexico and Taiwan, and between about 26,000 and 42,000 devices each in the United States, Germany, the United Kingdom, Australia and Canada over its observation window of 3 June to 1 October 2026.
How Android TV box malware like XCPE stays on a device
The technical detail explains why this is harder to deal with than an ordinary malicious app.
It lives below the user. According to Google, the x.cpe package is preloaded in firmware and, "if uninstalled by a user, it automatically reinstalls from the /oem/ partition upon reboot". It runs with system-level privileges.
It switches off the protection. Google says the backdoor "first wipes user consent configuration on the device and then disables Google Play Protect", Android's built-in malware scanner.
It takes orders remotely. A persistent connection to the operators handles "silent app installations, arbitrary shell commands, screen captures, and network reconnaissance". Google also observed operators "capturing live screenshots; injecting keystrokes; exfiltrating sensitive data including account information" and establishing reverse shells.
It kept evolving. Since August 2026, Google says, new droppers disguised as system packages have used an exploit to gain root and install themselves into the system partition. Charley Snyder, who heads disruption operations at Google's threat group, told CyberScoop that "the XCPE operators constantly evolved its configurations to evade Google's pre and post-launch detections".
The proxy modules turned each box into what Google calls a residential proxy exit node: a service that "functions to route arbitrary traffic through the infected device on behalf of a remote threat actor". Google found as many as three residential proxy kits installed on a single device.
Dates, court orders and other places the coverage runs ahead
The exact date of the takedown has not been published. Google's post, dated 3 November, says the work happened "last week", which puts it in the final days of October. Coverage appeared from 2 November: Help Net Security published that day, and SecurityWeek says Google announced it "on Monday". Lumen's own post, published 2 November, says "Today, Lumen and industry partners took action". The most that can be said with confidence is late October to early November.
No court has been named. Google's post says "legal action" and names no court, case or filing, and none of the articles above links to one. That is a contrast with BADBOX 2.0 in July 2025, when Google said it filed a lawsuit in New York federal court. Until a filing is public, "legal action" is the accurate description.
The 10 million figure is an estimate of reach, not a count of XCPE devices. The confirmed XCPE number is more than 1.3 million. The larger figure is Google's assessment of other compromised devices that lose contact with the affiliates' servers.
"Disrupted" is not "solved". Google itself warns that the "underlying illicit market is resilient", and that "backdoor operators, ad-fraud rings, and residential proxy providers operate as an interconnected supply chain". Infected boxes still carry the backdoor in firmware; removing the servers removes the operators' control, not the code.
The pattern behind this Google botnet takedown
XCPE is the latest in a run of actions against the same economy, and the earlier ones show how the proxy traffic is used.
| Action | When | What was hit | Scale given by Google |
|---|---|---|---|
| BADBOX 2.0 | July 2025 | Preinstalled malware on uncertified Android TV devices | Over 10 million devices |
| IPIDEA | January 2026 | One of the largest residential proxy networks | Device pool cut by millions |
| NetNut (Popa) | July 2026 | Residential proxy network | At least 2 million devices |
| XCPE | Late October 2026 | Firmware backdoor from a certified manufacturer | 1.3 million, plus at least 10 million reachable |
Sources: Google on BADBOX 2.0, IPIDEA, NetNut and XCPE.
In the IPIDEA case, Google said that in a single week it saw "over 550 individual threat groups" using that network's exit nodes, and that "the activities included access to victim SaaS environments, on-premises infrastructure, and password spray attacks". For NetNut it counted 316 distinct threat clusters in one week of June, "including cybercriminal and espionage groups".
The difference this time is where the infection came from. BADBOX 2.0 involved uncertified devices. XCPE came from a manufacturer that was inside Google's certification programme and found a way past its tests. That is a supply-chain problem, not a careless-user problem.
Why an Android botnet matters to businesses running AI
A cheap box on the office network is a door into it. TrendAI puts it plainly: "If the devices were part of an organizational network, the attacker could gain access to the internal network as well." Google says such proxy applications "could open security vulnerabilities on the device's home network", and the same applies to a meeting room or reception screen.
Your IP address becomes someone else's cover. In its IPIDEA write-up Google warned that users who host exit nodes provide "their IP address and device as a launchpad for hacking", and may be "flagged as suspicious or blocked by providers".
Residential addresses defeat the usual filters. TrendAI notes that "blocklists of data-center ranges would not and did not catch this traffic". That is exactly what makes these networks useful for abusing AI services: scraping and repeated sign-in attempts look like ordinary customers when they arrive from home and small-business connections, and password spraying is one of the uses Google has documented. Google's threat group, in a separate post the same day, describes attackers hijacking enterprise access to AI models with stolen keys and credentials, with charges in some incidents above $100,000 in a single day. Our piece on the AI API key theft wave of October 2026 covers how stolen keys are used and what to lock down.
Practical steps for a business
Keep a device inventory. List everything with a network connection: TV boxes, signage players, conference room screens, smart speakers and anything a member of staff brought in. A device you do not know about cannot be checked or isolated.
Buy only Play Protect certified Android devices. Google's certified partners page says certified devices "are tested for security and performance and preloaded with Google apps". To check a device, Google's help page says to open the Play Store, tap the profile icon, then Settings, then About. Certification is not proof: XCPE shows a certified maker can cheat. It is still the minimum.
Segment the network. Put streaming boxes, signage and other gadgets on their own network or VLAN, with no route to file servers, admin panels or the machines that hold AI and cloud keys.
Watch outbound traffic. A TV box has no reason to hold long connections to unfamiliar servers or to move data while nobody is watching it. Egress monitoring, or a firewall that limits what these segments may reach, is what catches a proxy node. Google publishes indicators of compromise at the end of its XCPE post for teams that can use them.
Write procurement rules. No unbranded or marketplace streaming boxes on company networks; buy from known manufacturers; and replace any device from a maker that has been implicated. Google's advice to retailers is to "require independent security audits" from manufacturers and to "swiftly delist" those implicated in supply-chain abuse. A business can apply the same rule to itself.
Be sceptical of "paid bandwidth" apps. Google tells consumers to be "extremely wary of applications that offer payment in exchange for 'unused bandwidth' or 'sharing your internet'". On a work device, such an app is a residential proxy by another name.
The short version
Google cut off a botnet of more than 1.3 million Android TV boxes whose backdoor came from the manufacturer, banned that manufacturer from certified Android and says the same action cuts off at least 10 million more devices. The exact date and the legal mechanism have not been published. The lesson for a business is not about one manufacturer. Any cheap connected device can arrive compromised, turn an office connection into cover for attacks on other people's systems, and give an outsider a foothold inside. Know what is on the network, keep gadgets away from anything that matters, and watch what leaves.