SecurityNov 5, 2026, 5:00 AM UTC·2 min read

XCPE botnet infects 1.3 million Smart TV boxes, Google says

About 1.3 million Smart TV set-top boxes have been drawn into the XCPE botnet. Google says it has evidence the manufacturer loaded the malicious code at the factory.

A Smart TV set-top box connected to a television with a red warning symbol indicating a malware infection. — Image: Antyweb

Around 1.3 million Smart TV set-top boxes have ended up in the hands of a botnet known as XCPE, and Google says the trail leads back to the manufacturer. According to the company, it has evidence that the maker of the devices was involved and that the malicious code was installed before the boxes ever left the factory.

The botnet used the infected devices to make use of other people's internet connections. In practice, that means owners of the boxes were supplying bandwidth to an operation they knew nothing about, simply by plugging a TV accessory into their home network.

Malware that arrives in the box

The most worrying part of the story is the alleged origin of the infection. Most consumer malware reaches a device after purchase, through a bad app, a dodgy download or an unpatched flaw. Here, Google points to a different scenario: the code was reportedly present from the start, which would make it a supply chain problem rather than a user mistake.

That distinction matters. A buyer cannot realistically check what is written into a device's software at the factory, and standard habits such as avoiding suspicious apps would offer no protection against something that is already built in.

What it means for buyers

The case is a reminder that cheap connected devices can carry hidden risks, especially when they sit permanently on a home network and rarely get attention after setup. A box that quietly lends out your connection may also affect your network's performance and reputation online.

Google's claims about the manufacturer's role are the central allegation here, and the scale, 1.3 million devices, shows how far a single compromised product line can spread. Owners worried about their own set-top box should watch for official guidance from the manufacturer and security researchers on how to identify affected models and what to do with them.

Apps worth a look

SUMO: the number puzzle

Tap the right tiles, add them up, hit the target. Easy to learn, hard to master. Free, for all ages.

Dialo: learn languages by speaking

Talk to an AI conversation partner; every sentence comes back corrected and explained in your language. 9 languages, A1 to C2.

ediviewer: read EDI files like documents

Open EDIFACT and X12 messages, see every segment explained, convert to JSON/XML, export PDF and Excel. Runs locally, no upload.

giftdetect: the right gift in minutes

Pick who it is for, the occasion and their personality. The search engine reads product descriptions from local shops and ranks what fits. Free, no sign-up.

Tags:xcpebotnetsmart tvgooglemalwaresupply chain