--- title: "XCPE botnet: Google says 1.3 million TV boxes shipped with a backdoor" description: "Google says it has taken down XCPE, a botnet of more than 1.3 million Android TV boxes that it attributes to their Chinese manufacturer, Videostrong. According to Google, a backdoor with system privileges was built in at the factory, in devices sold under several brands." canonical: https://inyourgeek.com/en/articles/2026-11-03-botnet-xcpe-selon-google-1-3-million-de-boitiers type: article author: "Sébastien Soulier" publisher: "InYourGeek" language: en datePublished: 2026-11-03 dateModified: 2026-11-03 section: "Security" tags: ["botnet", "android", "malware", "google"] --- # XCPE botnet: Google says 1.3 million TV boxes shipped with a backdoor > Google says it has taken down XCPE, a botnet of more than 1.3 million Android TV boxes that it attributes to their Chinese manufacturer, Videostrong. According to Google, a backdoor with system privileges was built in at the factory, in devices sold under several brands. November 3, 2026 · Security · 3 min On Monday, 2 November 2026, Google announced that it had taken down the XCPE botnet, a network of more than 1.3 million compromised Android TV streaming boxes. The report published that day by its Threat Intelligence Group (GTIG), as covered by [Bleeping Computer](https://www.bleepingcomputer.com/news/security/google-disrupts-million-device-xcpe-android-malware-botnet-bans-tv-box-maker/), says these devices were not compromised through a vulnerability or a malicious app. Instead, the backdoor was reportedly built into their firmware during manufacturing. ## A manufacturer accused and banned from the Android ecosystem Google attributes the botnet to the Chinese manufacturer Videostrong Technology Co, and says it has high confidence in that attribution. The company is accused of deliberately installing a persistent backdoor in the devices it made, then selling access to them to criminal affiliates for profit. These accusations come from Google. They are reported here based on its report, as covered by Bleeping Computer. Google also says the malware was found on many models, under several brands, over a period of several years. It ran on dedicated infrastructure, and its configuration kept changing to avoid detection. Google has ended its relationship with Videostrong and revoked its licence to build Android TV devices that ship with Google apps and services. The company and any future affiliates can no longer make certified Android devices or supply software to certified manufacturers. ## What the backdoor could do The main component, known as `x.cpe` and `com.oemservice`, runs with Android system privileges. At startup, an infected device contacts a command server on the `anyevonline[.]com` domain to get the credentials for an MQTT messaging server, hosted at `mqtt.szbboys[.]com`. That server is where the device gets its instructions. Through this channel, the operators could install apps without the user's knowledge, disable Google Play Protect, run commands with system privileges, take screenshots and simulate keystrokes. They could also collect account information, device details, the list of installed apps and system logs, and scan the local network. Affiliates then deployed their own modules. Some turned the box into a residential proxy, sending other people's internet traffic through the owner's connection without the owner's knowledge or consent. Others carried out ad fraud by loading hidden pages and clicking on ads. Still others installed more backdoors, named Moyu, Spirit and Bird. ## An operation wider than XCPE The takedown was carried out with Japan's National Police Agency and the security companies Lumen, HUMAN Security, Plume, Synthient and TrendAI. Google says it took down command servers used by more than a dozen related malware families, cutting off access to at least 10 million more devices. Those devices were compromised in other ways than XCPE. They include set-top boxes sold in shops, karaoke machines and telehealth equipment, and not all of them run Android. ## How to check whether your box is affected The source does not list the affected brands or models. Still, some of the published details let you run a first check: - look for a component named `x.cpe` or `com.oemservice` in the app list, including system apps, if your box lets you see them; - check whether Google Play Protect is disabled even though you never turned it off yourself, since disabling it is one of the reported capabilities; - check your router or DNS resolver logs for requests to any subdomain of `anyevonline[.]com` or to `mqtt.szbboys[.]com`. The takedown cut off the command servers, but the source does not say the embedded code has been removed from the devices. Because it is part of the system software itself, the safest step if you have any doubt is to disconnect the box from your home network. According to Google, the owners of these 1.3 million boxes were not attacked after they bought them. The devices were already compromised when they left the factory. ## Sources - [Google disrupts million-device XCPE Android malware botnet, bans TV box maker](https://www.bleepingcomputer.com/news/security/google-disrupts-million-device-xcpe-android-malware-botnet-bans-tv-box-maker/) — bleepingcomputer.com _Article written with AI assistance from the cited sources, reviewed and approved by a human before publication._ --- Equivalent HTML page : https://inyourgeek.com/en/articles/2026-11-03-botnet-xcpe-selon-google-1-3-million-de-boitiers Published by InYourGeek — https://inyourgeek.com/en/a-propos Method and safeguards : https://inyourgeek.com/en/methode All articles : https://inyourgeek.com/en/archives