# Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access

> **Open Intelligence Dossier** · First detected: 2026-11-02 22:20 UTC · Category: Technology

## Executive Summary
Google has disrupted a 1.3 million-device Android botnet linked to an Android partner selling criminal access.

## Intelligence Brief
Recent reports from multiple technology and cybersecurity publications detail a major infrastructure disruption involving millions of infected devices. According to coverage from The Verge, The Register, 9to5Google, Google Cloud, and The Hacker News, Google successfully shut down a sneaky malware backdoor embedded within Android TV and Google TV boxes. The operation targeted the XCPE botnet, which comprised approximately 1.3 million infected set-top boxes globally. Coverage indicates that one of Google's own Android hardware partners deliberately turned these consumer devices into active components of a vast criminal botnet by selling direct access to malicious actors. Publications such as The Register and The Hacker News emphasize that law enforcement agencies participated in busting the operation alongside Google's technical mitigations.


Google Cloud released specific technical documentation detailing the takedown under the title Shutting the Door on the XCPE Botnet. Meanwhile, outlets like 9to5Google and The Verge focus on the mechanism of the malware backdoor and the hardware partner's role in facilitating illicit operations through commercial set-top boxes. The reporting highlights the dual nature of the threat, involving compromised supply chains and direct monetization of device access by hardware manufacturers. This incident brings renewed attention to the security vulnerabilities inherent in consumer smart home hardware, particularly low-cost streaming and set-top boxes running the Android operating system. Coverage does not yet specify the exact identity of the Android partner accused of selling criminal access, nor does it detail all downstream victims of the botnet's activities.


The background established by the reports shows a growing trend of threat actors utilizing Internet of Things and media consumption devices to scale botnet infrastructure, bypassing traditional endpoint security solutions typically found on personal computers and smartphones. As the situation unfolds, future coverage will likely monitor further law enforcement announcements regarding the bust and any subsequent legal actions against the implicated TV box maker. Observers are also waiting to see whether Google or other industry partners will implement new verification standards for hardware manufacturers to prevent similar supply chain compromises. For now, the available information remains limited to the technical briefings provided by Google Cloud and the initial reporting from specialized cybersecurity news outlets regarding the 1.3 million-device network.

## Multi-Source Evidence Table
| Source Outlet | Headline | Verification URL |
|---|---|---|
| The Verge | One of Google’s Android partners turned 1.3 million set-top boxes into a botnet | [Source Link](https://news.google.com/rss/articles/CBMidkFVX3lxTFBlcGNqdk0ybzhTTFVsSVdZQUc4eU9TY0E0bjQyRFRGRlpMTEh5SE5MaHRQWDVEdGk3V20wZURJckg4ckNxb2NzZTJpLWJyNk9DRHJKV3UzYXJUbkVnMHN0N3dBTkRaU1lxQWhWMkI2bzU0ZHdaOWc?oc=5) |
| The Register | Cops bust botnet of 1.3M infected Android TV boxes | [Source Link](https://news.google.com/rss/articles/CBMirAFBVV95cUxPdE9KazZoLTNLSlJpU2YxU3VNc1Nub0hkSUFXME11c040X0NybFZGWDFKcVZmM0kyRWFXLWU5S1BjYVVISVFLYk00aGM0OGF2UGtrcUJFaF9RRU9IMzNyV0U0MjJoT0NSbURLemxZZVY2QkJSRXRDWHluS0JSYlV5d3ZWNWMwaERVYlRicEQ0Z2ljZXUwc1BpMmZwdE1xMld2dEFwekNvQnB0Um1R?oc=5) |
| 9to5Google | Google shuts down a sneaky malware backdoor on millions of Android TV and Google TV boxes | [Source Link](https://news.google.com/rss/articles/CBMigAFBVV95cUxNRDVkU1NSMjFMV1ZERjRHV3dib2RWVUNvR2d6YXY4NHNtaTZxSVB3Mjc3Wk40dG10b3JFeGlYNXBQcF9UM1dqcXNLaHZzSTl6WXM4WlhjWWJBRU1wUmNaX0RtdWFIRllkcWxRVkF3SXBpUmFMNzUyU2pOcThZTDF0ZA?oc=5) |
| Google Cloud | Shutting the Door on the XCPE Botnet | [Source Link](https://news.google.com/rss/articles/CBMimAFBVV95cUxORmJ2VVhPbGtGcWJHSGJKcV9UUHU1NzJrdWxPYndXeFNhSDdtaWtZWFl0NFJuQjFYM3pJbVlDR2J6eDdIejBQazh3RDhHYTgweGdvUHllajQyenl2UDB4dVIyZEdzd3Q0RXRHT2xDWEFzcVJlUERFRmkzZkQ4aTd2bEpEQnl2M1NfbHRxQXlONTdTaDg0S3o1aw?oc=5) |
| The Hacker News | Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access | [Source Link](https://news.google.com/rss/articles/CBMifEFVX3lxTE1rQy1rOGdyelRlR3lnRFBNM3hxQ3VqMU1lUjd0bHR2V2hkaDl4VDNQZTgzbHY2SU9NNWJxcTJvOU14ekRRRng4bjhLM0NVMEFBZDhpVGlqc3lSU3M0OUN4RFdvcnFKNnRqLUlHRXdoWDc1WVZqREFEUDJ3Vnc?oc=5) |

---
*Canonical Source: https://pulse.byoaiapps.com/trend/2026-11-02/google-disrupts-1-3-million-device-android-botnet-says-tv-box-maker-sold*