Google took down the XCPE botnet, but the TV boxes are still infected

What Google announced

On November 2, 2026, the Google Threat Intelligence Group published "Shutting the Door on the XCPE Botnet". Together with Japan's National Police Agency and Lumen, HUMAN Security, Plume, Synthient and TrendAI, Google dismantled a backdoor called XCPE that had enrolled more than 1.3 million set-top boxes in a botnet. Google assesses that Videostrong Technology (a Shenzhen-based OEM/ODM) developed, deployed and operated it for profit, renting access to third parties for ad fraud, residential proxying and loading more malware.

Google cut ties with Videostrong, revoked its license to ship devices with preloaded Google apps and changed its review process: the malicious code loaded after the first boot, which let it pass certification tests¹.

What was removed… and what was not

What Google took down was the control infrastructure: the domains and servers Videostrong used to run the botnet and install modules, plus those of more than a dozen malware families loaded through the backdoor¹. That cuts the orders. It is not a cleanup of the devices.

The main component, x.cpe (also com.oemservice), is preloaded in the firmware partition and runs with system privileges (android.uid.system). According to Google, if a user uninstalls it, it reinstalls itself from the /oem/ partition on reboot, and it "cannot be removed by the user"¹. The announcement does not say the backdoor was removed from devices already in homes, nor how to remove it.

In other words: the box still carries, in its firmware, a system-privileged backdoor that starts with it. The servers that commanded it being down is good news, but it does not change what is installed on the device. This is our inference, not a Google claim: as long as that component stays and keeps running, the device keeps the door open, waiting for any server that starts giving it orders again. Google itself admits "the underlying illicit market is resilient"¹.

Why uninstalling or rebooting is not enough

• It lives in the firmware, not in an app the user installed.
• It reinstalls itself from /oem/ on every reboot if removed.
• It disables Google Play Protect on the device¹.
• These were certified devices. They were sold as certified Android: the malicious code loaded after the first boot and so passed Google's tests^1,2. Certification was not enough of a guarantee.
• Since August 2026, packages disguised as system apps, installed over MQTT, have been seen escalating privileges and installing themselves into /system/priv-app/¹.

It is the same underlying mechanic we describe in BADBOX 2.0: malware that ships with the box and that no Play Store app can touch.

How AMK fixes it

Taking servers down is network-side work. AMK fixes XCPE on the device side: with root access to the TV box, it actually disables the malware (x.cpe / com.oemservice, already in AMK's catalog) so it stops running. A disabled component does not run, so it does not even try to reach the command servers, neither the current ones nor any that appear in the future. That is exactly what shutting down the servers cannot do. The scan is free and you only pay if a threat is found; AMK compares the device's real system against its catalog and picks the cleanup method by brand and model.

What Google recommends

Buy connected devices only from reputable manufacturers (although, as this case shows, certification alone was not enough), keep Play Protect active, review the permissions of third-party VPNs and proxies, and be wary of apps that pay you to "share your internet" or "unused bandwidth"¹.

Geographic scope: Google describes the botnet as "globally dispersed" and publishes no per-country figures. Infobae also reports TrendAI's count (1,472,554 devices of 206 models in more than 170 countries)²; it does not mention Latin America either. We do not know which specific models circulate in our markets.