Google and partners including Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI have disrupted XCPE, a botnet of more than 1.3 million Android TV boxes and other devices in over 200 countries. Google's Threat Intelligence Group says "with high confidence" that Shenzhen device maker Videostrong Technology built the backdoor into its firmware during manufacturing and sold access to criminal affiliates.

Those affiliates installed modules for ad fraud and residential-proxy services, which route other people's traffic through the owner's home connection, according to BleepingComputer. Google says it also took down command servers used by more than a dozen related malware families, cutting off at least 10 million more compromised devices, including set-top boxes, karaoke machines and telehealth hardware.

Google has cut ties with Videostrong and banned it and future affiliates from making certified Android devices. The Register notes Videostrong did not immediately respond, and that XCPE belongs to the same ecosystem as BadBox 2.0, disrupted in 2025.