The XCPE Android TV box botnet is a reminder that the device in your waiting room may deserve the same security attention as the laptop at your front desk.

Coeus inspects a streaming box and network cables in an office, illustrating the Android TV box botnet.

A streaming box is easy to overlook. Someone plugs it into a television in the lobby, connects it to Wi-Fi, and moves on. It may stay there for years, quietly running alongside the rest of the business network.

That ordinary device is now at the center of a major cybersecurity story.

As The Record reported, Google and its partners dismantled a botnet built from more than 1.3 million connected devices, primarily Android TV boxes. The network, known as XCPE, used malicious software embedded in devices to give its operators a way to control them and deliver additional malware.

For business owners, the lesson reaches beyond television boxes. Connected devices in waiting rooms, conference rooms, break rooms, and other overlooked spaces all deserve a place in the organization’s security plan.

What Happened with the Android TV Box Botnet?

In its technical report on XCPE, Google said the backdoor was built into devices sold under multiple brands and models over several years.

Google assesses with high confidence that Videostrong Technology, an Android device manufacturer, intentionally developed and operated the backdoor for financial gain. According to Google, the company sold access to criminal affiliates, whose software could use the devices for advertising fraud, route internet traffic through them, and install additional malware.

Google and its partners took action against the domains and servers used to control the botnet and its associated malware. Google also said it cut ties with Videostrong and made changes to its device review process.

The takedown is significant, but it does not automatically remove malicious software from every affected device. Google found that the backdoor was embedded in firmware and could reinstall after a user removed it.

Why Would Criminals Want a TV Box?

A botnet is a collection of connected devices controlled by an outside party. Each individual device may seem insignificant, but thousands or millions of them can provide computing power, network access, and internet connections that criminals can use at scale.

In the XCPE case, one use was a residential proxy network. An infected device could route someone else’s internet traffic through its owner’s connection. Other malware modules conducted advertising fraud or downloaded additional malicious software.

Google also observed operators performing sensitive actions on affected devices, including capturing screenshots and extracting information. That does not establish that every affected device experienced the same activity, but it shows why an unexpected device on the network deserves investigation.

What Does This Mean for Phoenix Businesses?

Most small and mid-sized businesses pay close attention to computers, servers, and employee accounts. The television in a waiting room or the digital sign in a lobby may not receive the same scrutiny.

Google found that most XCPE devices were TV boxes, but the affected group also included some telehealth devices, karaoke machines, and digital signage equipment. Any of those devices may be connected to a business network while sitting outside the normal process for inventory, updates, and security monitoring.

In our previous article, AI Is Shrinking the Time Businesses Have to Patch, we discussed why businesses need to know which devices require updates and who is responsible for them. This incident adds another question: Do you know every device connected to your network in the first place?

Coeus checks a clipboard while reviewing connected office devices, including a TV box, printer, and camera.

An inventory will not catch every threat on its own. It gives your IT team a starting point when a manufacturer, model, or type of device appears in a security alert.

Five Steps Businesses Can Take

1. Find the devices people have forgotten

Walk through the office and list internet-connected equipment, including streaming boxes, smart TVs, cameras, printers, signage players, and conference-room devices. Record the manufacturer, model, location, purpose, and who is responsible for it.

Ask employees and outside vendors about equipment they installed. The device may have arrived with a service contract or been purchased for a single event.

2. Check devices against available research

For Android TV boxes and related equipment, compare model information with the device model list published by Synthient. Treat a match as a reason for further investigation; model information alone may not establish whether a particular device is infected.

Your IT provider can also review Google’s published indicators and network activity as part of the assessment.

3. Disconnect suspicious devices and investigate

If a device is confirmed or reasonably suspected to be affected, disconnect it from the network and involve your IT team. Keep the device and any relevant records available for review.

Because Google found the XCPE backdoor in firmware, a factory reset or a simple app removal should not be assumed to make an affected device safe. Confirm a trusted remediation path with the vendor and your security team; replacement may be the practical choice if one is unavailable.

Coeus separates a streaming box and guest devices from an office workstation behind a partition.

4. Separate connected devices from sensitive systems

A streaming box generally does not need the same network access as a workstation handling customer records or financial information. Separate networks and appropriate access controls can limit which business systems a connected device can reach.

Segmentation does not guarantee that a malicious device cannot communicate with the internet. It is one layer of a broader security strategy that should also include monitoring and clear device ownership.

For a related look at separating sensitive systems, see our guide to PCI and FTC compliance for Arizona auto dealerships.

5. Review how connected equipment is purchased

Buy from reputable manufacturers and sellers, check the device’s support and update policies, and make sure someone owns the decision to connect it.

Google recommends using trusted app stores and keeping protections such as Google Play Protect active. These safeguards help, but they are not foolproof: some affected devices passed parts of Google’s certification process, and Google found that XCPE could disable Play Protect’s app verification. An enabled protection setting alone does not establish that a device is clean.

Frequently Asked Questions

Does this mean every Android TV box is infected?

No. The investigation involved specific devices and software. Use the manufacturer and model information as a starting point, and ask your IT team to investigate a suspected match.

Is the threat over now that Google dismantled the botnet?

Google and its partners disrupted important infrastructure, but disruption does not necessarily remove the backdoor from devices. Affected equipment still needs to be assessed.

Should my business remove every smart device?

Not necessarily. Start by identifying what is connected, why it is needed, how it is supported, and what it can access. Then prioritize devices that are unsupported, suspicious, or unnecessary.

Who should handle the review?

Your internal IT team or managed service provider should own the inventory and investigation, with help from the employees and vendors who know where devices are located.

Have a technology problem or question you’d like to discuss?

Coeus Consulting helps small and mid-sized businesses understand the technology they depend on, assess cybersecurity exposure, and make practical decisions that balance security with uptime.

Contact Coeus Consulting to discuss your technology

About Coeus Consulting

Coeus Consulting is a Phoenix-based managed IT services provider and MSSP serving small and mid-sized businesses across managed IT, cybersecurity, cloud, and compliance. We help organizations make practical technology decisions that improve resilience without losing sight of business reality.

About the Author

Linus Malefors
Managing Director, Coeus Consulting

Linus Malefors is an accredited technology consultant with over 30 years of experience serving Phoenix small and mid-sized businesses. He has supported more than 1,000 organizations throughout his career, and his leadership at Coeus Consulting has earned him two MSP Titans of the Industry finalist honors and a place among the 2026 AZ Champions of Change finalists. His technology expertise spans cybersecurity, cloud, AI, infrastructure, and regulatory compliance.

Sources referenced in this article: