# Google Dismantles XCPE Botnet Hidden in 1.3 Million Android TV Boxes and Bans Maker Videostrong

*2026-11-07 15:00 UTC · Technology · 1 min read*

> Google says Shenzhen-based Videostrong built a backdoor into certified Android TV boxes and sold access to criminals; it banned the firm and took down the botnet's infrastructure.

Google and industry partners have taken down the XCPE botnet, built into more than 1.3 million Android TV boxes. Google's Threat Intelligence Group attributes it with high confidence to Shenzhen manufacturer Videostrong Technology, which it says developed the backdoor and sold access to criminal affiliates. Security firm TrendAI counted 1,472,554 infected devices across 206 models between June and October.

The boxes had passed Android TV certification, unlike earlier botnets such as BADBOX and Vo1d that lived on uncertified hardware. The backdoor disabled Google Play Protect. Google banned Videostrong, took legal action against the botnet's domains and servers, and tightened firmware integrity checks for certified hardware. Malaysia, Brazil, Iraq, Mexico and Taiwan were hit hardest.

Google expects the action to cut criminals off from at least 10 million more compromised devices. The takedown does not clean infected boxes, however, and the malware can reinstall itself from the /oem/ partition.

## Sources

- [thenextweb.com](https://thenextweb.com/news/google-videostrong-xcpe-botnet-android-tv-boxes)
- [therecord.media](https://therecord.media/google-dismantles-botnet-hidden-android-tv-boxes)

---
TechTools News · https://techtools.cz/tools/news/article/2652-google-dismantles-xcpe-botnet-hidden-in-1-3-million-android-tv-boxes-and-bans
Česká verze: https://techtools.cz/tools/news/clanek/2726-google-zlikvidoval-botnet-xcpe-ukryty-v-1-3-milionu-android-tv-boxu-a-zakazal