# Google disrupts X.CPE botnet of 1.3 million Android TV devices with malware built into firmware

- Published: 2026-11-08 22:46 UTC
- Section: Digital & Computing › Data security
- Tags: X.CPE botnet, Android TV malware, Google botnet takedown, Videostrong Technology, firmware malware, infected TV boxes, ad fraud, traffic rerouting
- URL: https://realtech.media/news/rt-9090b50e11ebcfdcf1dc690a_google_disrupts_x/

**Malware was built into Android TV devices in over 200 countries, so owners installed nothing. Disabling the control infrastructure did not clean the devices themselves.**

![Google disrupts X.CPE botnet of 1.3 million Android TV devices with malware built into firmware](https://realtech.media/media/2026/11/f2a79be076aee6b5.webp)
*dnevnik.si*

Google and cybersecurity experts have disclosed X.CPE, a botnet of more than 1.3 million Android TV devices in over 200 countries, dnevnik.si reports, citing The Record. [1] Many users did not know their devices were infected. [1]

Most of the devices were TV boxes running Android TV. Other Android devices were also affected, including telemedicine equipment, karaoke systems and digital advertising displays. [1]

## Malware inside the operating system

According to Google, the malicious code was built directly into the devices, and the case is linked to the Chinese manufacturer Videostrong Technology. [1] Users did not need to install a suspicious app: the malware was already part of the operating system, so a device could join a criminal network without its owner's knowledge. [1]

Researchers stress that this was not a single vulnerability. By their account, the malware was built into various models and brands over several years. [1] Google says Videostrong gave criminal groups access to infected devices and let them install additional malicious programs. [1]

The infected devices were used for online fraud and unauthorized rerouting of network traffic. They could become part of networks that criminals use to hide their activity online and to access websites. Such networks can also serve ad fraud, with fake ad views and clicks generating revenue. [1] Google said the attackers used dedicated infrastructure and varied configurations to make detection harder. [1]

## Response and what remains

Google worked with cybersecurity companies and Japanese investigative authorities. [1] It ended its cooperation with Videostrong and barred it from making devices with preinstalled Google apps. [1] Videostrong did not respond to The Record's request for comment. [1]

Google and its partners disabled the infrastructure used to control the botnet. The operation also covered domains linked to other criminal networks, making access to many infected devices harder for the attackers. [1]

This does not mean the infected devices were cleaned automatically. When malware sits in system software or firmware, removing it is considerably harder than deleting an ordinary app, and in some cases it can reactivate after a restart. [1]

## Sources

1. [dnevnik.si](https://www.dnevnik.si/novice/svet/imate-android-tv-google-odkril-nevarnost-ki-se-je-skrivala-v-1-3-milijona-napravah-2839022)

---

Source: RealTech, realtech.media — https://realtech.media/news/rt-9090b50e11ebcfdcf1dc690a_google_disrupts_x/