A TV box could keep streaming normally while selling access to the network behind it. Google says the XCPE backdoor came built into the firmware of more than 1.3 million set-top boxes, allowing operators to install other companies’ malware and turn household devices into proxy exits and advertising-fraud workers.
In its November 2 investigation, Google Threat Intelligence Group attributed the operation to device manufacturer Videostrong with high confidence. Google and partners disrupted its command infrastructure the previous week. That intervention cuts control paths; it does not establish that the firmware on every affected box has been cleaned.
The backdoor returned from a second partition
The revealing detail is what happened after removal. The package, named x.cpe or com.oemservice in different builds, ran with Android system privileges. A copy stored in the /oem/ partition could install the app back into /data/app/ on reboot. Removing the visible app therefore left the mechanism that could recreate it.
This was not simply a bad streaming app a customer chose to download. Google says malicious software was embedded across different models and brands over several years. Its assessment is that the manufacturer deliberately operated the scheme for financial gain. Google has banned Videostrong and future affiliates from making certified Android devices or supplying software to certified vendors.
Certification had not caught the entire behavior: Google says obfuscation let malicious code load after a device’s first boot, exploiting a gap in testing. It has changed its review process. The lesson is more specific than “avoid unknown apps”: software already supplied with the hardware can undermine the protections users rely on.
One controller, several ways to earn from your connection
XCPE first obtained configuration and then maintained a command connection using MQTT, a lightweight messaging protocol. Operators could order silent installations, execute commands and capture screens. Google reports observing sensitive actions including screenshots, keystroke injection and data exfiltration; these are observed capabilities and activity, not proof that every owner had every type of data stolen.
The backdoor often passed work to a separate loader, com.abc.nexus, which initialized the money-making modules. Splitting communication from execution helped keep the visible controller small while loading changing payloads. In newer activity, Google found more specialized droppers replacing that general-purpose loader.
The distinction matters because removing one module does not necessarily remove the controller. The diagram also shows that affiliates had their own command servers. Google’s disruption targeted both the main operation and domains used by more than a dozen malware families.
Residential proxy modules relayed someone else’s traffic through the household internet connection. To the destination, that traffic could appear to come from the owner’s public IP address. Advertising modules generated fraudulent activity, while additional backdoors could install still more components. Google found an especially telling consent shortcut: one embedded proxy SDK was initialized by setting an opt-in flag without showing a consent screen.
1.3 million boxes is not the same as 10 million cleaned devices
Google’s separate estimate of at least 10 million additional compromised devices concerns access through the disrupted affiliate infrastructure. Those affiliates distribute modules through channels beyond XCPE. It is not a count of extra XCPE TV boxes, and it is not confirmation that all those devices were disinfected.
Most XCPE infections were Android TV set-top boxes, although Google also observed other Android-based equipment. Its report does not justify treating every Android TV device, or every product sold under a particular reseller’s name, as infected.
What an owner can establish now
If your box is suspected or confirmed to be affected, disconnect it from the network while checking its exact model and firmware with the seller or manufacturer. That is a containment step based on the reported remote-control mechanism. Ask for a supported remediation that addresses the firmware; ordinary app removal or an unexplained reset is not evidence that the preloaded copy is gone.
Google recommends reputable manufacturers, trusted app stores and keeping Play Protect active. Those are useful precautions, but Google also found that this backdoor could disable app verification. A reassuring setting alone cannot certify the firmware. Avoid installing unverified “XCPE removal” APKs or enabling remote debugging for strangers offering a fix.
The recent Windows fake-installer investigation shows a different route to the same business model: selling computing resources and internet access after installation. Here, the harder trust failure happened before the buyer even switched the device on.
References
Google Threat Intelligence Group. Shutting the Door on the XCPE Botnet. Google Cloud, November 2, 2026. Accessed November 4, 2026.
