Google says XCPE botnet infected 1.3 million set-top boxes

Google says it and several industry partners have dismantled the XCPE backdoor and botnet after finding the malware pre-installed on more than 1.3 million set-top boxes. The company says the operation was tied to Videostrong Technology, an Android original equipment manufacturer and original design manufacturer, and was built to make money from infected devices rather than being a one-off accidental compromise. ¹

What Google says happened

According to Google Threat Intelligence, XCPE gave criminal affiliates access to devices through firmware-level malware. Google says the backdoor could survive an attempted removal because it was pre-loaded in the firmware partition and restored itself from the device’s OEM partition after a reboot. The company describes a modular system in which a backdoor handled command-and-control communication while separate loaders and modules carried out the operators’ instructions. ¹

The reported activity included ad fraud, silent enrolment of devices into residential proxy networks, data exfiltration and the installation of additional malware. Google says the botnet used a two-stage command-and-control process, including MQTT communications, to receive configuration and instructions. The company’s diagram of the malware ecosystem shows the chain running from infected Android TV hardware through the backdoor and loader to remotely hosted modules. ¹

Google also says it found the software embedded across multiple device models and brands over several years. The company attributes that persistence to obfuscation techniques that allowed malicious code to be added after a device’s initial boot, bypassing parts of the certification process. The official report does not publish a complete list of affected consumer models, so owners cannot use the announcement alone to determine whether a particular box is exposed. ¹

The disruption

Google says it took legal action against the domains and servers used to control the botnet and install malware modules. It also says it took action against command-and-control domains associated with more than a dozen malware families that had been loaded as modules through the backdoor. ¹

The company says it has banned Videostrong and future subsidiaries or affiliates from building or selling certified Android devices, or supplying software to other certified vendors. Google is also changing its firmware-integrity review process for certified Android TV devices. ¹

Google estimates that disrupting the affiliate command-and-control domains could sever access to at least 10 million additional compromised devices. That is the company’s assessment of the wider impact, not an independently established count of devices affected by XCPE itself. ¹

What owners should take from this

The announcement is a warning about the risk of buying streaming hardware from poorly documented manufacturers, but it is not a consumer-facing recall or a complete diagnostic guide. Google has not, in the material published here, named every affected model or provided a public checker for individual devices. Owners who cannot establish the provenance and firmware-update support of a set-top box should avoid treating a factory reset as proof that it is clean: Google’s account specifically describes malware that could persist in firmware. ¹

Our opinion

The most important detail is not the headline number but the alleged route into the hardware. A backdoor placed in firmware sits below the layer most owners know how to reset, which makes ordinary troubleshooting a poor answer if the report’s description is accurate. Google’s disruption may cut off the infrastructure, but the episode also exposes a certification gap: a device can look like an inexpensive Android TV box while hiding a security problem that users have no practical way to inspect. The missing model list is therefore a serious limitation. Until affected products are named or a checker is available, buyers should favour hardware with a clear manufacturer, a credible update history and transparent certification rather than assuming a reset will solve everything.