Google says it dismantled a 1.3 million-device set-top-box botnet

Google's Nov. 2, 2026 post says it and partners dismantled the XCPE backdoor last week, after it enrolled more than 1.3 million set-top boxes, and that Google has banned Videostrong Technology from certified Android devices. Google assesses with high confidence that Videostrong built the preloaded firmware backdoor for profit and sold access used for ad fraud, residential proxies, and further malware, and that disrupting affiliate control domains should cut access to at least 10 million more devices. Trend Micro's same-day release matches the device count, puts the boxes in more than 200 countries, and Google says the backdoor reinstalls after a reboot, so sold devices are not described as clean.