A streaming box could keep playing video while quietly putting its owner’s internet connection to work for someone else. That was the problem behind XCPE, a botnet affecting more than 1.3 million set-top boxes across over 200 countries, according to a joint announcement published November 2.
Google led the disruption with Plume, TrendAI, Lumen, HUMAN Security, Synthient and Japan’s National Police Agency. The partners describe a supply-chain compromise: the unwanted software was embedded in device firmware before the boxes reached customers.
The investigation started with network traffic
Plume says its researchers followed repeated connections to a suspicious domain and traced them to a hidden Android firmware agent. The company stresses that ordinary playback performance did not reveal the problem. It recommends that service providers scrutinize suppliers, commission independent firmware-integrity audits and confirm certification before bundling Android TV hardware.
In its technical report, Google attributes the operation to manufacturer Videostrong with high confidence. Google says the backdoor was deliberately deployed for profit and used to deliver affiliates’ malware, support advertising fraud and turn household devices into residential proxies.
Disrupting the business behind the botnet
The coordinated action targeted control infrastructure and the domains used by additional malware modules. The joint announcement describes unauthorized bandwidth resale and collection of device, network and account information among the activities uncovered.
Google also says it banned Videostrong and associated future entities from producing certified Android devices, and changed its review process after finding that malicious code could evade initial checks.
How to read the takedown claims
Plume describes the threat as remediated in its message to partners. Google’s report also warns that the wider market for backdoors and illicit proxy access can adapt after an operation like this. Those statements concern different scopes: disrupting this network is not a blanket assurance about every streaming box or unrelated malware family.
For buyers and network operators, the case adds a concrete question to hardware procurement: what evidence supports trusting the firmware and the supplier behind it?
Sources: Google’s technical findings, the partner announcement and Plume’s account of the investigation. All published November 2, 2026.
Image: AI-generated editorial illustration created for DaySec. It does not depict an actual incident or product interface.
