Who is affected
People who own Android TV set-top boxes (streaming boxes that plug into a TV), especially low-cost or off-brand ones. Google says the malicious software was "built directly into many different device models and brands over multiple years," and that most infected devices were Android TV set-top boxes, with some telehealth devices, karaoke machines and digital signs too (Google Threat Intelligence). Google does not list the consumer brands or models, so there is no official list to check your box against. The report is about TV boxes and similar gadgets, not phones.
What happened
On November 2, 2026, Google reported that it and industry partners had dismantled a botnet it calls XCPE the week before. Google says, with high confidence, that the device maker Videostrong Technology Co. deliberately built a backdoor into its boxes and sold access to criminal affiliates. Google says the backdoor pulled more than 1.3 million set-top boxes into a botnet. The affiliates' software used infected boxes for ad fraud, turned them into residential proxies (so strangers' internet traffic ran through owners' home connections), and loaded more malware. Google also saw the maker's own operators take data such as account and device information. All of this happened without owners' knowledge or consent (Google Threat Intelligence). Google took legal action to take down the servers that controlled the botnet, cut ties with Videostrong, and banned it from building certified Android devices or supplying software to certified makers. Google says this maker got past its compatibility and security tests by loading the malicious code after the device's first startup, and it has changed its review process (Google Threat Intelligence, CyberScoop). We aren't sharing technical details of the malware.
The control servers are down, but the software is still on infected boxes. It is built into the box's firmware (the box's core software) and reinstalls itself if removed, so cleaning it takes clean firmware, or the box should be disconnected from the internet (BleepingComputer). Owners can't remove it themselves; cleanup needs action from the maker, platform protection, or replacing the device (TrendAI).
What to do now
- Do this now: check whether your Android TV box is Play Protect certified. Open the Google Play Store app, open Settings from your profile, and tap About to see "Play Protect certification." If it says "Device is not certified," or there's no Play Store at all, Google says to check its list of certified devices (Google Play Help). Google also notes that uncertified devices "may not be secure" and may not get updates. Google's page doesn't mention TV boxes, so the menus on your box may look different.
- Good to know: certification alone is not proof a box is clean. Google says this maker's code got past its tests (Google Threat Intelligence).
- If your box is off-brand, uncertified, or you aren't sure where it came from, CyberSandberg tip: unplug it from the internet (or remove it from your Wi-Fi) and plan to replace it. Deleting apps won't remove this kind of backdoor (BleepingComputer).
- When you buy a streaming box, Google says to buy connected devices only from reputable manufacturers and points to its Android TV website for the current list of partners. Google also says to make sure protections like Google Play Protect are turned on (Google Threat Intelligence).
- CyberSandberg tip: if you signed in to streaming or other accounts on a box you're replacing, change those passwords from a different, trusted device.
- Google also warns to be wary of apps that offer payment for "unused bandwidth" or "sharing your internet" (Google Threat Intelligence).
Dates
- Event date: takedown the week before November 2, 2026 ("last week," per Google; exact date not given).
- Reported: Google report Nov 2, 2026. BleepingComputer, CyberScoop and TrendAI: Nov 2, 2026.
- Date checked: Nov 3, 2026.
Sources
- Google Threat Intelligence Group, "Shutting the Door on the XCPE Botnet," Google Cloud Blog, Nov 2, 2026 (checked Nov 3, 2026)
- BleepingComputer, "Google disrupts million-device XCPE Android malware botnet, bans TV box maker," Nov 2, 2026 (checked Nov 3, 2026)
- Google Play Help, "Check & fix Play Protect certification status" (checked Nov 3, 2026)
- CyberScoop, "Google shuts down global botnet running on certified Android devices," Nov 2, 2026 (checked Nov 3, 2026)
- TrendAI Research blog, "TrendAI Research Helps Disrupt Botnet of More Than 1.3 Million Pre-Infected Set-Top Boxes," Nov 2, 2026 (checked Nov 3, 2026)