Google bans TV box maker it ties to X.CPE botnet on 1.3M devices

Google and six partners announced on November 2 that they had taken down X.CPE, a botnet built into the firmware of more than 1.3 million Android TV set-top boxes before they were sold. In its technical write-up, Google Threat Intelligence Group said it assesses "with high confidence" that the backdoor was built and run for profit by Videostrong Technology Co., an Android device manufacturer, and that Google has banned the company from making devices with preloaded Google apps.

The malware came inside the device and, by Google's account, got past Google's own pre-release tests by loading its code after the box first booted. Google also took action against the command domains of more than a dozen affiliate malware families loaded through the backdoor, which it assesses will cut off access to at least 10 million more compromised devices.

The partners were Plume, TrendAI (Trend Micro's enterprise unit), Lumen, HUMAN Security, Synthient and Japan's National Police Agency. Google dated the takedown to the week before the announcement.

What Google did

• Legal action to take down the domains and servers used to control the botnet and install malware modules.

• Legal action against the command domains of more than a dozen malware families loaded through the backdoor.

• A ban on Videostrong and any future subsidiaries or affiliates building or selling certified Android devices, or supplying software to certified vendors.

• Changes to its review process and to how it checks the integrity of firmware on certified Android TV devices.

How the boxes made money

Google said Videostrong sold access to "criminal affiliates" and loaded their modules onto the boxes. Most turned a box into a residential proxy exit node, renting out the owner's home internet address and bandwidth to third parties; others ran ad fraud or installed further backdoors. The backdoor ran with system privileges, reinstalled itself after removal and switched off Google Play Protect's app checks.

One ad-fraud module Google described fetched ad placements in the background and fired the tracking links that register an impression, without displaying the ad. TrendAI said each box generated impressions from a real home connection, "which ad verification treats as genuine audience."

A device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust, and represents a serious risk to those users.Google Threat Intelligence Group, November 2, 2026

What each partner counted

Google, TrendAI and Plume published their own research. Their counts differ because each saw the botnet from a different place; TrendAI calls every one of its figures a lower bound.

Sources: TrendAI Research, Plume Security Labs, Google. Plume's figure is one moment's connections to two control servers; it estimates more than 1.3 million devices in all.

The joint release says more than 200 countries; TrendAI's telemetry covered more than 170, with Malaysia, Brazil, Iraq, Mexico and Taiwan recording the most devices. TrendAI said the operator scheduled its proxy and ad-fraud modules onto about 1.33 million boxes, which SaasBuzz calculates is 90% of the devices TrendAI counted. HUMAN and Synthient gave statements to the release, and Lumen appears only in its boilerplate; none of the three had published a separate write-up that SaasBuzz could find by 8:20 a.m. ET.

What it means for device makers, ISPs and ad buyers

Device makers. When Google sued the operators of the BadBox 2.0 botnet in July 2025, it said the more than 10 million devices involved were uncertified ones running Android's open-source code, without Google's protections. X.CPE is a different problem: Google says the manufacturer went through its compatibility and security tests and loaded the malicious code afterward. So the fix sits in Google's own review and firmware checks.

Internet providers. Plume, which supplies home Wi-Fi software to internet providers, said its investigation began when a questionable domain was flagged in a device's MQTT request, a messaging protocol common in connected devices, and that the package's name appeared to mimic operator-managed equipment to avoid suspicion. Plume also pointed out that a subscriber can put a router into bridge mode but cannot replace a set-top box the same way. TrendAI said the exit addresses sat on networks including Comcast, Charter and AT&T in the US, Virgin Media in the UK and Vodafone in Germany. Taking down the servers cut the operator off, TrendAI said, but "the implant remains on each box"; Plume recommends a full factory reset of any affected device.

Ad buyers and fraud teams. Traffic from these boxes comes from the same home networks as real customers; TrendAI said blocklists of data-center addresses "would not and did not catch this traffic." The numbers show why address lists struggle: over four months TrendAI saw 3,849,226 distinct exit addresses, about 2.6 for every device it counted, while the pool on an average day, 182,025 addresses, equaled about 12% of that device count. TrendAI recommends combining network fingerprints with behavior, such as repeated failed logins, rather than relying on IP reputation alone.

What comes next

Google said it does not expect the takedown to end the trade. "Backdoor operators, ad-fraud rings, and residential proxy providers operate as an interconnected supply chain," it wrote, and operators "quickly pivot to new loaders or rival monetization SDKs." Google said the operators had already started installing new dropper packages, disguised as Android system apps, in August. It asked retailers to require independent security audits from device makers and told consumers to buy set-top boxes only from reputable manufacturers, with Play Protect switched on.

Videostrong had not commented publicly on Google's findings by 8:20 a.m. ET on November 2, as far as SaasBuzz could find.