Google Search interest in "botnet" had spent most of October sitting flat at an index of 3 to 6. On November 2 it doubled to 7, as Google's report on the XCPE takedown went out: more than 1.3 million Android TV set-top boxes that shipped with a firmware backdoor secretly renting their owners' internet connections to criminals. The story took the number 20 slot on the Google News Top News board on November 3. The twist is who built the backdoor. Google's Threat Intelligence Group says the manufacturer did it on purpose, and has cut the company off from certified Android devices. The attention data above is why the story is breaking now.
The search curve moved before the headlines did
The search curve gives the story away before the headlines do. Daily Google Search interest in "botnet" ran 3 to 6 through most of October, touched 7 on October 28-29, sank back to 3 on November 1, then jumped to 7 again on November 2. That second jump lines up with the announcement cycle: Google's report and the partner release are dated November 2, and Krebs on Security's writeup is dated November 3, per the publication timestamps on the cited pages. Search data runs through November 2, so the November 3 coverage bump is not in the numbers yet. There was also a larger October 10 spike to 15, for a cause the data does not identify. The October run of this site's Android security coverage, including the SMS of Death exploit piece, suggests the audience for this kind of disclosure-cycle story is already here.
What Google says Videostrong did
XCPE was not the work of outside hackers breaking into devices. Google's Threat Intelligence Group says it assesses "with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.," an Android device maker based in Shenzhen, China. The backdoor arrived pre-installed in the firmware of the company's TV boxes, built to evade Android's pre-release security checks, and it reinstalled itself on reboot.
Videostrong monetized the implant two ways, according to the Google report and Krebs on Security's writeup: by selling access to criminal affiliates, and by loading those affiliates' malware modules onto the infected boxes. The affiliates used the devices for advertising fraud and as residential proxies, selling strangers the right to route traffic through owners' home connections. Google says its partners in the operation included Plume, TrendAI, Lumen, HUMAN Security, Synthient, and Japan's National Police Agency.
Why 1.3 million is probably low
Synthient founder Ben Brundage called the 1.3 million figure "highly conservative," telling Krebs, "The scale of affected devices is likely way higher." The evidence backs that read: Synthient examined MECOOL-branded boxes made by Skyworth Technology, a publicly traded Chinese company, and found they carried the same Videostrong malware. The same XCPE malware also turned up in Android-based telehealth devices, karaoke machines, and digital signage, according to the Google report. Google took legal action to take down the domains and servers controlling the botnet, and says severing the affiliate infrastructure should cut criminal access to at least 10 million additional devices.
One honest gap: killing the command servers does not uninstall the backdoor. Google's own report notes that Videostrong's proxy and ad-fraud affiliates "each have diversified distribution channels for their modules beyond XCPE," so whether the 10 million number holds depends on affiliates not rebuilding on fresh infrastructure.
What Google did about the maker
Beyond the takedown, Google severed ties with Videostrong and banned the company, plus any future subsidiaries or affiliates, from building or supplying software for certified Android devices. Krebs also names some of the residential proxy services whose software the botnet installed, including AppSalt (also known as Honeygain) and NetNut, the latter already targeted by an FBI domain seizure in July 2026 over a separate TV box botnet called Popa. For readers keeping score on the year's biggest takedowns, the Binance hack recovery story this site covered two days ago is the other half of the pattern: criminals build infrastructure at scale, and law enforcement takes the servers, not the devices. The week's trending topics will show how long this one holds attention.
