Google and its partners disrupted the XCPE botnet’s command-and-control infrastructure, which had been used to manage infected Android TV boxes. The reported action targeted the network controlling the malware, not a device-by-device firmware-removal process. That distinction matters because the implant was embedded in device firmware and an attempted uninstall could be followed by automatic reinstallation.
How the disruption affected the botnet
Google and Japanese law enforcement, along with cybersecurity firms, disrupted domains and related infrastructure used to control XCPE. Google linked the campaign to Videostrong Technology Co. and reportedly cut ties with the company, barring it from making devices with preloaded Google apps.
The malware was used for activity including residential proxy traffic, ad fraud, data exfiltration and loading additional malware. Charley Snyder, head of disruption operations at Google Threat Intelligence Group, said severing the domains effectively rendered the malware benign. That describes the effect on its communications; the reported operation itself was a network-level disruption.
TrendAI counted more than 1.4 million infected devices
TrendAI counted 1,472,554 infected devices across 206 models between June and October 2026, according to a report by Cybersecurity ASEAN. The figure adds a specific measurement period and model count to the broader report that more than 1.3 million devices were affected, most of them Android TV boxes.
What Android TV box owners can take from the advice
Google reportedly advised users to check that Play Protect is on and to buy set-top boxes from reputable manufacturers. TrendAI’s reported analysis found that the XCPE implant ran as a system app signed with a manufacturer key, disabled Play Protect and could not be removed by owners. An enabled Play Protect setting, by itself, therefore does not establish that a device’s firmware is free of the implant.
