XCPE Android TV Box Botnet Disrupted; Malaysia Among the Worst-Hit Countries, Google Blames Maker Videostrong

A botnet built from Android TV boxes that came with malware already installed has been disrupted by Google, Japan's National Police Agency and several security firms. TrendAI, one of the partners, counted "1,472,554 infected devices across 206 models" in more than 170 countries between June and October 2026, and lists Malaysia, Brazil, Iraq, Mexico and Taiwan as the countries with the most.

The botnet is called XCPE. Google's Threat Intelligence Group says it was "intentionally developed, deployed, and operated for financial gain" by Videostrong Technology, a device maker in Shenzhen. Videostrong did not immediately respond to The Register.

What was taken down

Google says it took legal action against the domains and servers Videostrong used to control the botnet and install malware modules, along with the control servers of more than a dozen affiliated malware families. Taking those down cuts off at least 10 million additional compromised devices, it says. Google has also cut ties with Videostrong and banned it from making devices with Google's apps preloaded.

Google found the malware built into many device models and brands over several years.

Why owners can't fix it

The implant runs as a system app signed with the manufacturer's key, so owners cannot remove it themselves, TrendAI says. It also switches off Google Play Protect.

Because of that, Google tells owners to check that Play Protect is turned on and to buy set-top boxes only "from reputable manufacturers". TrendAI advises avoiding unbranded or uncertified Android TV boxes and apps that pay users for sharing their bandwidth.