On November 3, 2026, Google's Threat Intelligence Group announced the disruption of X.CPE, a botnet built into more than 1.3 million Android TV set-top boxes. Google worked with Japan's National Police Agency and with Lumen, HUMAN Security, Plume, Synthient and TrendAI. The company says it assesses "with high confidence" that the OEM Videostrong Technology developed and operated the backdoor for financial gain. Google has cut ties with Videostrong and barred it from building or selling certified Android devices. The Record reports the infected boxes spanned more than 200 countries.
This was a rare, well-executed private-public disruption, and it deserves credit. It also exposes a structural problem that no single takedown fixes.
What actually happened
According to Google's report, the malware was not delivered by a phishing link or a sketchy app. It shipped inside the firmware. The architecture was modular and three-stage: a primary backdoor, a loader, and monetization modules. If a user uninstalled the backdoor, it reinstalled itself from the /oem/ partition on reboot. It also set a Play Protect consent flag so that it would not be flagged.
Monetization ran through affiliates. Google says Videostrong sold access to criminal affiliates and loaded their malware modules onto infected devices. The modules it names include residential-proxy and bandwidth-resale software. The Record adds that the uses included ad fraud, data exfiltration and paid app installs. Google also says the takedown of affiliate command-and-control domains may have cut off access to at least 10 million additional compromised devices, many of them not Android.
Google's report says Videostrong used obfuscation techniques to exploit a gap in Google's certification tests. Google also says that since August 2026 the malware has been disguised as system apps. These are not the actions of a rogue insider, a point Google makes itself. Google's own words: it does not believe the campaign was "an isolated rogue insider or a development oversight."
The strongest case for heavy regulation
The case for mandatory rules is strong, and it should be stated fairly. Buyers of a $30 set-top box cannot inspect firmware, cannot realistically evaluate an anonymous OEM, and bear none of the costs when their bandwidth is resold to fraudsters. The FBI's June 2025 public service announcement on BADBOX 2.0 described "millions of infected devices" and said most were manufactured in China. It listed streaming devices, projectors, vehicle infotainment systems and picture frames. X.CPE is the latest case of the same pattern: cheap hardware, pre-installed malware, and a market that gives consumers no way to tell the difference. Voluntary good behaviour has plainly not been enough, and a regulator could reasonably say the market has failed.
Why the fix is certification integrity, not blanket mandates
The lesson of X.CPE is narrower than "regulate IoT." The failure was a gatekeeping failure. Videostrong passed Google's certification tests while carrying the malware. A new statute would not have caught that. Better tests would have.
That points to a proportionate, evidence-based response with three parts.
- Verify what ships, not what is presented for testing. Google says it is changing firmware-integrity checks for certified Android TV devices. Certification should include reproducible builds and image attestation, not just lab behaviour on a test unit. Obfuscation that evades a one-time test is much harder to hide from continuous verification.
- Make the baseline legible. NIST IR 8259 Rev. 1, finalized in April 2026, describes the cybersecurity activities manufacturers should perform before IoT products are sold. A voluntary but widely recognised baseline lets retailers, platforms and procurement officers filter out vendors who cannot show they follow it, without a new licensing regime.
- Put accountability on the party that can act. Platform gatekeepers, retailers and marketplaces can delist a vendor in days. Google's ban on Videostrong shows how quickly a certification-based sanction works compared with cross-border litigation.
This approach protects the open ecosystem that makes cheap Android hardware possible. Android's openness lets small OEMs compete and puts affordable devices in millions of homes. Blanket rules that raise compliance costs for every small manufacturer would hit honest vendors hardest. Videostrong already operated outside the rules, so a new rulebook would not have deterred it.
The gaps that remain
Three weaknesses stand out.
Victims are not yet made whole. The Record notes that Google did not say whether customers will be notified or whether infected devices will be cleaned. Google's chief disruption officer says the takedown leaves the malware "effectively rendering the malware benign" by cutting its command infrastructure. That is a different outcome from removing it. The code stays on the boxes, and a new operator could in principle take over its infrastructure. Consumers who bought the devices still hold compromised hardware.
Recurrence is the base rate. BADBOX was disrupted in 2024, and the FBI's June 2025 alert says BADBOX 2.0 was found after that. X.CPE is a third case of the same pattern. One takedown per generation will not scale against a business model that earns money from residential-proxy resale.
Enforcement against the manufacturer is limited. Google could ban Videostrong from its ecosystem, but a ban does not reach a company that ships devices without Google apps. Videostrong did not respond to The Record's request for comment. Governments and platforms should share indicators faster across borders, so that one vendor's ban becomes a signal to retailers and other platforms.
What policymakers should take from it
The useful lessons for policy are specific. Fund and standardise firmware attestation. Require transparent disclosure when a platform decertifies a vendor, so retailers can act. Build notification and remediation channels for owners of affected devices. These steps are cheaper and more targeted than a general mandate, and they address the failure this case actually revealed. Where governments do legislate, they should aim at the point where the failure occurred: testing that a determined vendor can game.
The X.CPE operation shows what coordinated defenders can achieve. It also shows that a certification regime tested only once, on a unit the vendor chooses, will keep being beaten.