Google shut down the command servers for a network of 1.3 million Android TV boxes that came with hidden harmful software. Here is how to check yours.
Google and partners shut down the command servers for a large network of hacked Android TV streaming boxes. Google says more than 1.3 million of these boxes came with hidden harmful software already built in when they were made. If you use a TV streaming box from a brand you do not know well, check it today and think about replacing it.
What happened
According to BleepingComputer, Google and industry partners took apart a botnet called XCPE. A botnet is a large group of hacked devices that criminals control from far away.
Google worked with Japan's National Police Agency and several security companies. Together they took down the control servers used by more than a dozen related malware families. Malware means harmful software. This also cut off access to at least 10 million other hacked devices. Those included store-bought set-top boxes, karaoke machines and telehealth hardware. Telehealth hardware is equipment used for doctor visits over the internet. Google says not all of these devices run Android.
Google says it has high confidence that the box maker, Videostrong Technology Co, put the hidden software in on purpose. Google has ended its relationship with the company. It also took away the company's license to make Android TV devices with Google apps, and banned it from making certified Android devices.
How the trick works
Most hacked devices are broken into through a software flaw or a bad app. This case was different. The harmful code was placed in the box's firmware at the factory. Firmware is the basic software that runs a device, below the apps you see. That means the owners did nothing wrong. The danger came in the box.
Google says the hidden code runs with system-level power. That is the highest level of control on the device. When an infected box turns on, it reaches out to a server on the internet to get its orders. After that, the people running it can control the box from far away.
Google says the maker sold this access to criminal partners. Those partners used the boxes for:
- Ad fraud: using devices to cheat online ad systems for money.
- Residential proxies: letting strangers send their internet traffic through your home connection, so it looks like it comes from you.
- More malware: installing other harmful programs on the box.
Google also says this code was found in many brands and models over several years. It kept changing to avoid being caught.
Who is at risk
- Families who bought an Android TV streaming box, especially from a brand they do not recognize.
- Small businesses such as bars, shops or waiting rooms that use set-top boxes or karaoke machines.
- Clinics and patients who use telehealth hardware at home or at work.
The report does not list every affected brand or model. So you cannot rely on a simple list. It is smart to check any little-known device that plugs into your TV and your Wi-Fi.
This is not the only news about hacked devices this week. The weekly recap from The Hacker News listed hidden networks of hacked devices among the week's big problems. It also noted that some attacks started with small things, such as a device with no password.
Steps to stay safe
- Find out what you own. Look for the brand and model on the box, the packaging or the settings menu. Search the brand name with the words XCPE or Videostrong to see if it is linked to this news.
- Choose certified devices. A certified Android device is one Google has approved to come with its apps and services. Buying well-known brands from trusted stores lowers your risk.
- Keep smart devices apart. Many home routers offer a guest Wi-Fi network. Put TV boxes and other smart gadgets there, away from your computers and phones.
- Install updates. Turn on automatic updates for your TV devices and your router when the option exists.
If you think yours is infected
- Unplug it. Remove the box from power and from your network.
- Do not count on a reset. The code lives in the firmware, so a factory reset may not remove it. Replacing the box is the safest choice.
- Change passwords. Change the passwords for any accounts you signed into on the box, such as streaming or email accounts.
- Change your Wi-Fi password. Do this if the box was on your main home network.
- Check your router. Look at the list of connected devices and remove any you do not know.
- Tell the right people. At a business or clinic, tell whoever manages your computers and network.
The server takedown is good news, because it cut off the criminals' control for now. Still, the hidden code is part of the box itself. A calm, simple check of your devices this week is the best next step.
Have a question about anything here? Email me at sales@appwt.com or call (888) 565-0171, and I will answer it.
Sources
- Google disrupts million-device XCPE Android malware botnet, bans TV box maker, BleepingComputer, 2026-11-02
- ⚡ Weekly Recap: Critical CVEs, Linux DDoS Botnet, Device-Code Phishing, Android Spyware and More, The Hacker News, 2026-11-02
Tags
Frequently Asked Questions
Did I do something wrong if my TV box was infected?
No. Google says the harmful code was built into the box's firmware when it was made. The owner did not have to click or install anything.
Will a factory reset fix an infected TV box?
It may not. The code is in the firmware, the basic software below the apps. Replacing the box is the safest choice.
What were the hacked boxes used for?
Google says criminals used them for ad fraud, for sending other people's internet traffic through owners' homes, and for installing more malware.
Is it only Android TV boxes?
No. Google says the takedown also cut off at least 10 million other devices, including set-top boxes, karaoke machines and telehealth hardware. Not all of them run Android.
Enjoyed this article?
Share it with your network
