Google announced on November 2-3, 2026 that it had disrupted XCPE, a botnet of more than 1.3 million devices, mostly Android set-top boxes. Searches for "google android botnet takedown" climbed this week in the US. If you own a cheap Android TV box, this one is worth ten minutes of your attention, because the takedown cut the criminals' servers but did not remove the software from the boxes themselves.
What happened
According to reporting from SecurityWeek and The Record, Google worked with law enforcement in Japan and several security companies to take legal action against the domains and servers that controlled XCPE. The botnet spanned more than 200 countries. Google also said the action may have cut criminal access to about 10 million additional compromised devices, many of them not Android.
Google tied the scheme to Videostrong, a Chinese Android device maker. Google said it cut business ties with the company and banned it from producing devices with preloaded Google apps. Videostrong did not respond to requests for comment in the coverage we reviewed, so treat the allegations as Google's account of events.
How the infection worked
The unusual part is where the malware lived. Reporting says it was built into the device firmware before the boxes reached customers, was designed to evade security checks, and reinstalled itself automatically if a user removed it. That is very different from a malicious app you can simply uninstall.
Infected devices were reportedly used as a residential proxy network. In plain terms, other people's internet traffic was routed through the victim's home connection, using the victim's IP address and bandwidth. Revenue streams described in the coverage included reselling bandwidth, data exfiltration, ad fraud, paid app installs and loading additional malware modules. Besides TV boxes, Google reportedly saw infected telehealth devices, karaoke machines and digital signage.
What the takedown did not do
Taking down command-and-control domains blocks the operators from instructing the devices, and Google said this effectively made the malware benign. But coverage notes that Google did not say whether affected owners would be notified or whether the malware would be forcibly removed. The sensible assumption is that a box which carried a factory backdoor is still a risk until you replace it or reflash it with trusted firmware.
A practical checklist for owners of Android TV boxes
The coverage we reviewed did not publish an official step-by-step check, so the points below are general good practice rather than Google guidance.
- Check who made your box. If it is an unbranded device from a marketplace listing, treat it with suspicion. Look up the model name together with the word "malware".
- Look for Play Protect certification. Certified Android devices pass Google's compatibility and security requirements. Settings menus differ by device, so search your box's settings for Play Protect or device certification.
- Watch your network. Unexplained constant traffic from one device, a slow connection, or your router flagging unknown destinations can all be signs of proxy abuse.
- Isolate smart devices. Put TV boxes and other IoT devices on a guest network so they cannot reach your laptops and phones.
- Replace rather than patch. If you suspect a box is infected, the safest option is a certified device from a known brand, and keeping the suspect box off your home network.
- Never sideload from unknown sources on a device that is already untrusted.
Why developers should care
Supply-chain attacks, where the compromise ships inside the product, are the same class of risk developers face with third-party SDKs and packages. If you build Android apps, the lesson is to audit every dependency and to treat pre-installed or bundled code as untrusted by default. Our guide to prompt injection and AI agent security covers the same mindset for AI tools: assume that anything you did not write can be hostile.
Frequently asked questions
What is the XCPE botnet?
XCPE is a botnet of more than 1.3 million devices, mostly Android TV set-top boxes, that Google and partners disrupted in early November 2026. Google linked it to firmware-level malware from the manufacturer Videostrong.
Is my Android TV box infected?
It depends on the model and where you bought it. Unbranded boxes from marketplaces are the main concern. Check the manufacturer, look for Play Protect certification, and search for your model name alongside reports of malware.
Did Google remove the malware from infected boxes?
Not according to the coverage we reviewed. The takedown disabled the servers that controlled the botnet, but reporting says the malware could reinstall itself and that Google did not confirm forced removal.
What is a residential proxy botnet?
It is a network of infected devices whose home internet connections are rented out so that other people's traffic appears to come from an ordinary household IP address.
Sources and further reading
- SecurityWeek: Google dismantles XCPE botnet
- The Record: Google dismantles botnet hidden in Android TV boxes
- BleepingComputer: Google disrupts million-device XCPE botnet
Facts in this article reflect public reporting as of November 7, 2026. Details such as dates, prices and rollout lists can change, so check the official source before you act on them.