Google’s Chinese Hardware Supplier Involved in Spying Through Set-Top Boxes, 1.3 Million Devices Affected

A massive global cyber espionage network operated directly out of 1.3 million consumer television set-top boxes has been exposed, revealing that living room entertainment systems across 200 countries were silently turned into covert spying stations.

The surveillance operation, powered by a factory-installed backdoor coded as XCPE, allowed operators to silently capture keystrokes, log active screen activity, exfiltrate user data, and bypass basic security protections the moment consumers powered up their streaming devices. Rather than being an external software hack, the espionage mechanism was built straight into the core firmware at the factory stage.

Living Rooms Turned Into Surveillance Outposts

Security investigations into the XCPE system revealed an unprecedented violation of consumer privacy. Built directly into the lower-level system partitions of cheap set-top boxes, the spyware disabled built-in security scanners and systematically granted remote operators unrestricted access to private household networks.

Once active inside a home, the covert system opened backdoor entry points to capture sensitive data, monitor internet traffic, and silently install additional malicious surveillance components. The compromised devices acted as secret network relays, routing unauthorized third-party traffic through innocent family internet connections and framing domestic households for illegal remote activities.

Global Extent of the Cyber Espionage

While streaming boxes accounted for the majority of compromised units, the surveillance code was also discovered pre-installed across a wider range of internet-connected appliances, including digital signage screens, home karaoke machines, and medical telehealth devices.

Active spying nodes were detected in more than 200 countries, spanning millions of households throughout Asia, Europe, North America, and Latin America. Because the spy code resided within the core firmware layer, traditional factory resets failed to clear the infection, leaving affected hardware permanently compromised as long as it remained connected to the internet.

International Infrastructure Takedown

The scale of the espionage ring prompted an international law enforcement crackdown involving Japan's National Police Agency alongside global security research groups including Trend Micro, HUMAN Security, and Synthient.

Courts and international authorities seized the remote control domains and took down the backend servers orchestrating the XCPE network. However, cybersecurity experts warn that because millions of compromised set-top boxes still physically exist inside consumer homes with factory-embedded backdoors, these devices remain severely vulnerable unless fully replaced or disconnected from home Wi-Fi networks.