Google shuts down 1.3 million Android TV botnet with Brazil as top hub
Google's Threat Intelligence Group dismantled the global XCPE botnet, which infected over 1.3 million devices, including up to 200,000 in Brazil.
Global tech giant Google has taken aggressive legal and technical action to dismantle a massive cybercriminal network that hijacked more than 1.3 million devices worldwide. On November 2, 2026, the Google Threat Intelligence Group disclosed the disruption of the "XCPE" botnet, a global network of compromised Android TV set-top boxes and smart devices that cybercriminals used to conduct large-scale advertising fraud and run illicit residential proxy networks.
Brazil has emerged as one of the hardest-hit hubs in this global security breach. Cybersecurity telemetry from threat intelligence firm TrendAI identified between 150,000 and 200,000 infected devices active within Brazil, making the country one of the primary targets and operational bases for the botnet. The high concentration of compromised hardware highlights the vulnerability of the local consumer electronics market to sophisticated supply-chain exploits.
According to Google's investigation, the security threat did not stem from external hackers exploiting a software bug, but from a trusted manufacturer. Google has permanently severed ties with Chinese hardware manufacturer Videostrong Technology Co., accusing the company of intentionally pre-installing the XCPE backdoor directly into device firmware during manufacturing. Videostrong reportedly bypassed Google's security certification checks by using obfuscation techniques that only loaded the malicious code after a user booted the device for the first time.
Once active, Videostrong allegedly monetized the backdoor by selling access to criminal affiliates. These affiliates installed secondary malware modules that silently turned the TV boxes, alongside some connected karaoke machines and telehealth devices, into proxy servers. This allowed bad actors to route malicious web traffic through unsuspecting consumers' home internet connections, masking cyberattacks and generating fraudulent ad clicks.
In response, Google has disabled the command-and-control domains used to manage the botnet and banned Videostrong from producing certified Android devices in the future. While the immediate threat has been disrupted, security researchers warn that the sheer volume of pre-installed backdoors in circulation means users in highly affected regions like Brazil must remain vigilant, keep their devices updated, and isolate unverified smart hardware on their home networks.
In your brokerage app
For investors tracking the digital advertising and cybersecurity landscape, this massive cleanup directly reinforces the defensive moat of Google's parent company, Alphabet Inc., which is listed in New York and widely held across major global technology exchange-traded funds.
