Google says it shut down XCPE, a botnet of 1.3 million hijacked TV streaming boxes

Google says it has shut down XCPE, a botnet of more than 1.3 million Android TV streaming boxes that left the factory with hidden software criminals used for ad fraud and other schemes.  The Google Threat Intelligence Group, the company's security research team, said in a Nov. 2 report that Google and partners dismantled the network "last week."

A botnet is a network of hacked internet-connected devices that someone controls remotely, usually without the owners knowing.  Most of the infected devices were set-top boxes, the small streaming boxes that plug into a TV to run apps, Google says, but it also found telehealth devices, karaoke machines and digital signs.  The malware turned up in many device models and brands over several years, in its current form since at least late 2024.

The entry point was a firmware backdoor.  Firmware is the basic software built into a device that runs it before any app opens, and a backdoor is hidden code that lets an outsider get in without passing normal security.  Google says XCPE was preloaded in the boxes' firmware with full system-level control.  That makes it different from a bad app an owner downloads and can delete:  if a user uninstalled it, it reinstalled itself when the box restarted.  It also switched off Google Play Protect, the malware scanner built into Android, so it could quietly install more software.

Google says it has "high confidence" the backdoor was built and run for profit by an Android device manufacturer, which it names in its report, and that the maker sold access to the boxes to criminal partners.  Those partners' add-ons faked views and clicks on ads in hidden windows, a scheme called ad fraud, and turned homes into "residential proxies," letting strangers route internet traffic through a household's connection so it looks like it comes from there.  Operators could also take screenshots, type on the device remotely, copy account and device information and run commands, the report says.

Google says it took legal action to take down the web domains and servers that controlled the botnet, plus the control domains of more than a dozen malware families that rode on it.  Because those families also spread other ways, Google expects the action to cut off at least 10 million more compromised devices.  It banned the manufacturer and its affiliates from making certified Android devices or supplying software to certified makers, and changed how it checks firmware on certified Android TV devices after finding the maker had exploited a gap in its tests by loading the malicious code after a device's first startup.  Partners included Japan's National Police Agency, internet backbone company Lumen and security firms HUMAN Security, Plume, Synthient and TrendAI.

This is not Google's first fight over TV boxes.  In July 2025 it sued the operators of BadBox 2.0, which it called the largest known botnet of internet-connected TVs, in federal court in New York.  That botnet compromised more than 10 million uncertified devices running Android's free open-source version, which lacks Google's security protections, Google said then.  In the new report, Google warns that the underground market is "resilient" and that operators quickly switch to new tools when one is shut down.

Google's advice for owners:  be "extremely wary" of apps that offer to pay for "unused bandwidth" or "sharing your internet," stick to app stores you trust, review permissions for VPN and proxy apps from outside companies, make sure Google Play Protect is turned on and buy streaming boxes only from reputable manufacturers.  Google keeps a list of certified Android partners on its Android website.  Its Google Play help page explains how to check whether a device is Play Protect certified, meaning it passed Google's compatibility testing, by opening the Play Store app's settings and tapping About.  Google says uncertified devices may not be secure or receive updates.

Google's report does not say how many of the infected boxes are in the United States or the Bay Area, and it does not list the affected brands and models by name.

Source: Google Threat Intelligence Group, "Shutting the Door on the XCPE Botnet," Nov. 2, 2026; Google, "Google takes legal action against Badbox 2.0," July 17, 2025; Google Play Help: Check & fix Play Protect certification status; Android certified partners list.