On 2 November 2026 Google Threat Intelligence said that last week it and its partners dismantled XCPE, a botnet built from more than 1.3 million Android set-top boxes in over 200 countries. The partners were Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and Trend Micro's TrendAI. Google says with high confidence that the backdoor was built and run for profit by Videostrong Technology, a company that makes Android devices for other brands (an OEM/ODM).
Infected before the box left the factory
XCPE was not something users downloaded. It came preinstalled in the firmware as a system app (x.cpe, package com.oemservice) running with system privileges. If someone removed it, a copy in the /oem/ partition put it back on the next reboot. It also switched off Google Play Protect's app verification.
Google says the backdoor has been developed since at least late 2024, with new dropper packages appearing since August 2026. Besides TV boxes, it showed up in telehealth devices, karaoke machines and digital signage. Videostrong got past Google's device testing by fetching the malicious code only after the first boot.
A control channel over MQTT
After a bootstrap over HTTP, each box kept a persistent MQTT connection to a broker at mqtt.szbboys[.]com on ports 3885-3887, and researchers saw an EMQX management console on that infrastructure. Over that channel the operators could install apps silently, run shell commands, take screenshots, inject keystrokes and pull data off the device.
The money came from modules loaded onto the boxes. Some turned them into residential proxies, selling the owner's home internet connection to third parties through services Google names, including Honeygain, NetNut, Traffmonetizer and EarnFM. Others ran hidden ad fraud, and some installed further backdoors. In late 2024 the modules moved to a separate loader, com.abc.nexus.
What the takedown did
Google took legal action against XCPE's command servers and domains, and against the command infrastructure of more than a dozen affiliated malware families. It estimates this cuts operators off from at least 10 million more devices. Videostrong and any future affiliates are banned from certified Android devices that ship with Google apps and from supplying software to certified vendors. Google has also changed how it reviews firmware integrity.
A TV box that has lost its command server is quieter, but the backdoor is still in its firmware. The reinstall trick means a factory reset or removing the app does not get rid of it.
What to check at home
Google's advice is to buy set-top boxes from known manufacturers on the Android TV partner list, to be wary of apps that pay you to "share your bandwidth", and to keep Play Protect turned on. For a cheap no-name box already on the network, the safer move is to take it off the network or put it on a separate guest or IoT network, away from cameras, NAS drives and the home automation server. Its traffic left through the owner's connection, so it was the owner's IP address that showed up on other people's servers.