Plume

MOUNTAIN VIEW – November 02, 2026 -- Google, Plume, TrendAI, Lumen, HUMAN Security, Synthient and Japan's National Police Agency have taken down X.CPE, a botnet hidden in more than 1.3 million TV set-top boxes across more than 200 countries. Google assesses that disrupting the botnet's command-and-control domains will also cut off access to at least 10 million additional compromised devices.

Malware shipped inside firmware before devices reached subscribers

X.CPE was embedded in device firmware before the set-top boxes were sold. Unlike threats that rely on a user opening an attachment or installing an app, it arrived as part of the device. Subscribers received no consent request, notification or opt-out option.

The malware was built to evade pre-release security checks. Google has since updated its review process and banned the responsible OEM, along with any future subsidiaries or affiliates, from making devices with preloaded Google apps.