Google and a group of security partners say they have disrupted X.CPE, a botnet hidden in more than 1.3 million Android TV set-top boxes across more than 200 countries. The case matters because the backdoor was present before the devices reached homes, letting criminals use subscribers’ connections without their knowledge or consent.

What Google says was hidden in the boxes

Google says X.CPE lived inside device firmware, where it ran with system-level privileges rather than as an ordinary app. The company says the code could disable Google Play Protect before loading more malware, giving operators a way to install software silently and keep control of the box.

According to Google, the devices were used for ad fraud, residential proxy services, bandwidth resale and additional malware delivery. Google also says the backdoor gave operators access to live screenshots, keystrokes, account details, device information, app lists and system logs.

Google says it is highly confident that Videostrong Technology, a Shenzhen-based manufacturer of Android TV boxes and other devices, intentionally built and operated the backdoor for financial gain. Google does not believe this was a mistake or the work of a rogue insider.

Why the takedown matters

The scale is larger than the botnet itself. TrendAI counted 1,472,554 infected devices across 206 models between June 3 and October 1, while Google and its partners said the campaign reached more than 1.3 million devices in more than 200 countries.

Google also says disrupting the command domains used by the affiliate malware modules could sever access to at least 10 million more compromised devices reached through other channels. That means the operation was aimed not only at the set-top boxes themselves, but also at the wider criminal infrastructure that used them.

Most of the infected devices were Android TV boxes, but Google says the backdoor also showed up in telehealth devices, karaoke machines and digital signage systems. The pattern points to a supply-chain problem: devices that appeared ordinary were already carrying hidden access when they were sold.

What Google changed after the discovery

Google says it has updated its review process for manufacturers and tightened firmware checks for certified Android TV devices after finding a gap that allowed the malicious code to load after first boot. It also cut ties with Videostrong and banned the company, along with any future subsidiaries or affiliates, from making certified Android devices or supplying software to certified makers.

Google says the backdoor is difficult to remove because it lives in firmware and reinstalls after reboot. Google took legal action against the botnet’s command infrastructure and updated its device review process.

The takedown involved Google, Plume, TrendAI, Lumen, HUMAN Security, Synthient and Japan’s National Police Agency. The companies said they combined security research, network visibility and threat intelligence to take down the botnet’s control infrastructure and the domains used by affiliated malware families.