The takedown cut the servers, not the implant
Start with what "dismantled" covers. Google and its partners took legal action against the domains and servers Videostrong used to control the botnet, and against the command servers of more than a dozen malware families the backdoor loaded as modules. Those actions disrupted the identified control infrastructure. They did not remove the malware from firmware already installed on devices, and Google warns that the wider criminal ecosystem can adapt by moving to other infrastructure.
The backdoor itself, tracked as x.cpe, is preloaded in the firmware partition and runs at system privilege. Google's analysis says that, as a system preload, it cannot be removed by the user; if uninstalled from the app directory, it reinstalls from the /oem/ partition on the next reboot. The takedown targeted the command-and-control infrastructure, not the firmware already installed on devices. Google has not published a count of how many previously enrolled devices remain infected or active after the disruption, and it provides no consumer removal procedure.
Built into the firmware, not installed later
This was not malware a user downloaded. GTIG says Videostrong, an original equipment and design manufacturer that builds Android TV boxes under its own brands and for other labels, embedded the backdoor during manufacturing and sold access to criminal affiliates. The affiliates' modules turned boxes into residential proxy exit nodes, ran advertising fraud, and loaded further backdoors. Through the control channel, operators could silently install apps, disable Google Play Protect, run arbitrary shell commands, capture the screen and inject keystrokes. Google says it observed exfiltration of account information, device information, package inventories and system logs.
Google is explicit that it does not read this as an accident: the software appeared across many models and brands over multiple years, with dedicated infrastructure and configurations that kept evolving to evade detection. Since at least late 2024 the design had become a modular, three-stage system built for what Google calls multi-tenant monetization, and new dropper packages disguised as system applications appeared as recently as August 2026.
The certification gap is part of the story
The backdoor was built into devices that entered the Android ecosystem with Google's apps. Google requires OEMs to pass compatibility and security tests before shipping Android devices with those apps. GTIG says Videostrong used obfuscation to exploit a gap in those tests, loading malicious code after a device's first boot, when the original checks had already been performed.
Google says it has since changed its review process and is improving how it checks firmware integrity on certified Android TV devices, and it has banned Videostrong, including future subsidiaries and affiliates, from making certified devices or supplying software to other certified vendors.
That sequence is worth sitting with. The ban is a significant supply-chain response, and the testing changes are intended to close the specific gap Google identified. Neither action removes the backdoor from firmware already installed on affected devices. That still leaves the buyer's question unanswered in advance: for several years, a certification mark coexisted with a factory-installed backdoor, because the check ran before the malicious code loaded.
Two numbers, two different things
The report carries a second, larger figure: Google assesses that taking down the affiliate command servers will sever access to at least 10 million additional compromised devices. Read it as written. Those are devices the affiliates reached through their other distribution channels, not 10 million more XCPE boxes, and the verb is "assess" — it is Google's estimate of an effect, not a verified count of devices cleaned. Coverage that adds the two numbers together, or reports 11 million devices fixed, is saying something the report does not.
Partner telemetry measures different aspects of the botnet. TrendAI counted 1,472,554 devices across 206 models between June 3 and October 1. Synthient estimated that approximately 500,000 devices were online at a given time. Google's figure of more than 1.3 million describes devices enrolled in the botnet. These numbers should not be averaged or treated as competing estimates of the same thing: enrollment, detection across a measurement window, and simultaneous online activity are different measurements. None establishes how many devices remain infected after the disruption.
What an owner can actually do
Less than the headline suggests. Google's report names no consumer-checkable list of affected models or brands, and for a system preload there is no uninstall step to publish. The realistic options sit outside the report: stop using a box from an implicated maker for anything signed-in, keep it off the home network or replace it, and treat "someone will patch it" cautiously — the party that would ship the firmware fix is the party Google accuses of building the backdoor. That is an uncomfortable position for a takedown announcement to leave the owners of potentially affected devices, and it is where this one leaves them.
Sources
- [1] Google Threat Intelligence Group, "Shutting the Door on the XCPE Botnet", Google Cloud Blog, November 2, 2026 (primary source, read first-hand — the 1.3 million enrolled devices, the high-confidence attribution to Videostrong, the firmware persistence and /oem/ reinstallation, the MQTT capabilities and observed exfiltration, the certification-test gap, the ban, and the 10 million affiliate-infrastructure assessment)Read source
- [2] The Register, "Cops bust botnet of 1.3M infected Android TV boxes", November 2, 2026 (Videostrong did not immediately respond to inquiries)Read source
- [3] BleepingComputer, "Google disrupts million-device XCPE Android malware botnet, bans TV box maker", November 2, 2026 (corroboration of takedown scope and affiliate-device context)Read source
- [4] Cyber Insider, "Google dismantles 1.3 million-device Android botnet, bans TV box maker", November 2, 2026 (Synthient investigation summary, including its estimate of about 500,000 devices actively online)Read source