Google Threat Intelligence Group says it has dismantled the XCPE backdoor, firmware malware that enrolled more than 1.3 million set-top boxes into a botnet. Google says a manufacturer, Videostrong Technology Co., built and ran it. Google links two of the malware families it loaded to the earlier BadBox operation.

What Google did

Google says it took legal action against the domains and servers Videostrong used to control the botnet and install malware, and against the command-and-control domains used by more than a dozen malware families loaded through the backdoor. It worked with industry partners, and Google names Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI.

Google also says it banned Videostrong and any future subsidiaries or affiliates from building and selling certified Android devices, or supplying software to other certified vendors. Videostrong can no longer make devices with preloaded Google apps. Google says it is improving how it checks firmware integrity on certified Android TV devices, and that Videostrong's obfuscation exploited a gap in its tests by loading malicious code after a device's first boot.

How big it is

Two figures matter, and both are Google's, not an independent count. The first is 1.3 million: set-top boxes Google says the XCPE backdoor itself enrolled. The second is separate. Affiliates bought access and loaded their own modules, and Google estimates that taking down their command-and-control domains will "sever access to at least 10 million additional compromised devices."

Google says the devices were mainly Android TV set-top boxes, with other connected gear such as digital signage and karaoke machines also affected. It says it assesses "with high confidence" that Videostrong developed and operated XCPE for financial gain, and that affiliates loaded ad-fraud tools, residential proxies and other malware.

How BADBOX comes into it

Google's post does not say XCPE is part of BADBOX. It says Videostrong removed malicious modules from the backdoor in late 2024, "possibly as a response to" earlier Google enforcement related to BadBox. It also describes two of the loaded modules, Moyu and Bird, as backdoors "previously tied to the BadBox enterprise."

Is your Android TV box affected?

Google's post does not name affected brands or models; it says only "many different device models and brands." That means there is no list to check your box against. What Google publishes for detection is technical: package names, files and network domains aimed at security teams. It describes infected devices as residential-proxy exit nodes. Google says the malware turns off Google Play Protect, so a box where Play Protect is off is worth suspicion, but uncertified boxes may not have Play Protect at all, so that is not a reliable test on its own. The post gives no user-facing test, so we cannot give you a reliable one.

What Google does recommend for people:

  • Buy from reputable makers. It points to its list of certified Android TV partners at android.com/certified/partners.
  • Be wary of "paid bandwidth" apps. Google warns against apps that offer money for unused bandwidth or for sharing your internet.
  • Keep protections on. Stick to app stores you trust, review permissions for third-party VPN and proxy apps, and make sure Google Play Protect is active.

If you own an uncertified Android TV box of unclear origin, the safest reading is to treat it with suspicion; that is our judgment, not Google's instruction. The same supply-chain risk showed up on phones, where Bitdefender reported Midnight Mimosa in firmware. For phone-side habits, see our Android scam protections checklist.

What this means for you

For most people the action is cautious shopping, not a fix. If your box came from a known brand sold through a major retailer, Google's post gives no sign it is involved, but it also does not clear any brand. Google itself says "this is not the end of our work," because operators can pivot to new loaders.

What we checked

The takedown, figures, Videostrong ban and user advice come from Google's post, read Nov. 2. Google's post lists no brands, and we did not test any device. The 10 million figure and the Videostrong attribution are Google's own assessments. The Midnight Mimosa link is separate context from our earlier story, not part of Google's post. We could not open the Synthient analysis of the operation, so nothing here relies on it.