Google-led coalition cuts off botnet hidden in Android TV boxes

Overview

Updated 1 hour ago

For years, cheap Android TV boxes from white-label brands shipped with a hidden passenger. The firmware carried a backdoor that turned buyers' devices into residential proxy nodes and ad-fraud engines, using home internet connections without consent.

On November 2, 2026, Google and a coalition of security firms, working with Japan's National Police Agency, said they had cut the operators off from the servers controlling more than 1.3 million devices. Google also banned the manufacturer, Videostrong, from building certified Android devices.

Why it matters

The takedown severs the operator's control, but the backdoor stays on every infected box.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

1,472,554

Infected devices observed

TrendAI's telemetry count across 206 models from June to October 2026.

206

Device models affected

White-label Android TV boxes carrying the pre-installed backdoor.

170+

Countries reporting infected devices

Malaysia, Brazil, Iraq, Mexico and Taiwan recorded the most devices.

1.33 million

Devices scheduled for proxy and ad-fraud modules

About nine in ten controlled devices were actively monetized.

3,849,226

Distinct residential exit IP addresses

The proxy product offered about 182,000 household IPs on a typical day.

10 million

Additional devices reachable via affiliate networks

Google says disrupting affiliate command domains could sever access to these devices.

2.36 billion

Control messages captured

Instructions sent to infected devices during the measurement window.

Voices

Curated perspectives — historical figures and your fellow readers.

Organizations Involved

Google

Technology company

Led the takedown; banned Videostrong from certified Android devices

Alphabet's Google runs the Android and Android TV ecosystems and certifies devices that carry its apps.

Videostrong Technology Co.

Android device manufacturer (OEM/ODM)

Banned from building certified Android devices

A Shenzhen-based manufacturer that builds Android TV boxes for white-label brands.

TrendAI

Cybersecurity research firm (Trend Micro)

Measured the botnet and helped disrupt it

The research arm of Trend Micro, which tracked the X.CPE operation from June to October 2026.

Japan National Police Agency

Law enforcement agency

Partner in the takedown

Japan's national police force, which joined the coalition disrupting X.CPE infrastructure.

Lumen Technologies

Telecommunications and cybersecurity company

Partner in the takedown

A network and security company that contributed threat intelligence to the coalition.

Timeline

2024 November 2026

4 events Latest: Today

Tap a bar to jump to that date

November 2026
Coalition announces takedown and Videostrong ban
Today Takedown

Google, security firms and Japan's National Police Agency cut off command servers and ban Videostrong from certified Android devices.
Today
June 2026
TrendAI begins tracking the operation
Investigation

Researchers start measuring the botnet, eventually counting 1,472,554 infected devices across 206 models.
June 3rd, 2026
March 2025
Related BADBOX 2.0 botnet disrupted
Takedown

A botnet in the same ecosystem is disrupted, but the underlying supply chain persists.
March 2025
2024
Videostrong malware goes modular
Malware evolution

The pre-installed malware shifts from simple droppers to a three-stage architecture built for resilience and multi-tenant monetization.
2024

Scenarios

Operators rebuild command servers within months

Likely Resolves by May 2, 2027

Discussed by: TrendAI and Google threat intelligence

TrendAI notes that operators of this kind have rebuilt on new infrastructure before. The implant remains on every infected box, so a new command server could re-enroll devices that are still online. The trigger is a new domain or message broker serving x.cpe traffic.

Affiliate malware networks stay offline

Possible Resolves by Feb 2, 2027

Discussed by: Google Cloud threat intelligence

Google took legal action against command domains used by more than a dozen affiliate malware families, which it says could sever access to at least 10 million additional compromised devices. If the domains stay down and no replacements appear, the affiliates lose a distribution channel.

Videostrong or a subsidiary returns to certified Android

Unlikely Resolves by Nov 2, 2027

Discussed by: Google's certification policy

Google banned Videostrong and any future subsidiaries or affiliates from building certified Android devices. The test is whether a related entity reappears on Google's certified-partner list under a new name.

Regulators open enforcement action against Videostrong

Uncertain Resolves by Nov 2, 2027

Discussed by: Security researchers and consumer-protection watchers

The takedown was led by a private company and police, not a regulator. A government agency could open a formal investigation or file a complaint over the pre-installed malware. No such action has been announced.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

March 2025

BADBOX 2.0 takedown (2025)

A botnet of infected Android devices, including TV boxes, was disrupted. It had been used for ad fraud and proxy services across many countries.

Then

Command servers were cut off and the operation was disrupted.

Now

The infrastructure and actors overlapped with later campaigns, and the ecosystem persisted.

Why this matters now

TrendAI places X.CPE in the same ecosystem as BADBOX 2.0, showing that takedowns do not end the underlying supply chain.

2016

Mirai botnet (2016)

Malware infected internet-of-things devices using default credentials and built a botnet that launched massive denial-of-service attacks, including one that knocked major websites offline.

Then

The source code leaked and variants spread quickly.

Now

It established the playbook for monetizing poorly secured consumer devices.

Why this matters now

X.CPE follows the same logic: consumer hardware with weak security becomes a rentable attack surface.

2018