Google and partners dismantle XCPE botnet on 1.3 million Android TV boxes
Published November 4, 2026 · Updated November 4, 2026 · 3 sources
Google says it dismantled the XCPE backdoor and botnet it attributes to Android device maker Videostrong. Company data are shown as of the November 3 close.
The exposed companies and what ATLAS says about each
There is no market close after the event yet: the reaction will be visible at the close of November 4. This page will be updated then with the actual change. In the meantime, here is the data for each company.
Google led the takedown of the XCPE botnet and cut ties with Videostrong, the Android device maker behind it. · Communication Services
Google led the takedown of the XCPE botnet and cut ties with Videostrong, the Android device maker behind it [1]. Alphabet's latest available close was $279.91 on November 3. The ATLAS fair value estimate is $224.80, and the dividend yield is 0.31%.
Latest available close
$279.91Close of November 3
Fair value (ATLAS)
$224.80Fair range: $142.14 to $355.53The price ($279.91) is 24.5% above that figure.
Chance of a rise in 1 month
49%Probability of closing higher than today within 21 sessions.Normal range: half of the scenarios end between $256.46 and $303.09; 9 in 10, between $221.15 and $351.48.
Recent results (EPS)
Oct 282.12 actual vs 2.94 est.Fell short
Jul 229.11 actual vs 2.90 est.Beat expectations
Apr 295.11 actual vs 2.67 est.Beat expectations
Apr 170.15 actual vs 0.22 est.Fell short
Dividend
0.31% dividend yieldNext ex-dividend date: December 7, 2026 · 0.86 $ over the last 12 months
Alphabet Class C shares; parent of Google, which led the takedown of the XCPE botnet. · Communication Services
Alphabet Class C shares; Alphabet is the parent of Google, which led the takedown of the XCPE botnet [1]. The latest available close was $278.30 on November 3. The ATLAS fair value estimate is $224.80, and the dividend yield is 0.31%.
Latest available close
$278.30Close of November 3
Fair value (ATLAS)
$224.80Fair range: $142.14 to $355.53The price ($278.30) is 23.8% above that figure.
Chance of a rise in 1 month
49%Probability of closing higher than today within 21 sessions.Normal range: half of the scenarios end between $255.68 and $300.84; 9 in 10, between $221.35 and $347.50.
Recent results (EPS)
Oct 282.12 actual vs 2.94 est.Fell short
Jul 222.85 actual vs 2.91 est.Fell short
Apr 292.76 actual vs 2.63 est.Beat expectations
Feb 242.72 actual vs 2.52 est.Beat expectations
Dividend
0.31% dividend yieldNext ex-dividend date: December 7, 2026 · 0.86 $ over the last 12 months
Cybersecurity platform provider, part of the endpoint and threat-detection market that handles botnet and malware threats. · Technology
CrowdStrike is a cybersecurity platform provider in the endpoint and threat-detection market; it is included for its activity in the sector, not because the event affects it. Its latest available close was $244.61 on November 3. Its next earnings report is December 1 after the close, with estimated EPS of 0.00.
Latest available close
$244.61Close of November 3
Chance of a rise in 1 month
48%Probability of closing higher than today within 21 sessions.Normal range: half of the scenarios end between $220.03 and $267.78; 9 in 10, between $184.87 and $318.69.
Palo Alto Networks is a cybersecurity vendor whose threat-prevention products address botnets and malware campaigns; it is included for its activity in the sector, not because the event affects it. Its latest available close was $350.10 on November 3, and the ATLAS fair value estimate is $148.61. Its next earnings report is November 18 after the close, with estimated EPS of 0.52.
Latest available close
$350.10Close of November 3
Fair value (ATLAS)
$148.61Fair range: $114.13 to $197.51The price ($350.10) is 135.6% above that figure.
Chance of a rise in 1 month
48%Probability of closing higher than today within 21 sessions.Normal range: half of the scenarios end between $317.29 and $381.60; 9 in 10, between $269.40 and $449.43.
Fortinet is a network security vendor whose products detect and block botnet command-and-control traffic; it is included for its activity in the sector, not because the event affects it. Its latest available close was $128.10 on November 3. The ATLAS fair value estimate is $113.36.
Latest available close
$128.10Close of November 3
Fair value (ATLAS)
$113.36Fair range: $92.31 to $139.21The price ($128.10) is 13.0% above that figure.
Chance of a rise in 1 month
45%Probability of closing higher than today within 21 sessions.Normal range: half of the scenarios end between $108.02 and $144.73; 9 in 10, between $83.35 and $187.57.
Google and industry partners dismantled the XCPE backdoor and botnet, which Google says was developed and operated for financial gain by Android device maker Videostrong Technology; it enrolled more than 1.3 million set-top boxes [1]. The market reaction will be visible at the close of November 4, the first session that can reflect the event, and this page will be updated then.
Google says it assesses with high confidence that the XCPE backdoor and botnet were intentionally developed, deployed and operated for financial gain by Videostrong Technology Co., an Android device maker. The backdoor enrolled more than 1.3 million set-top boxes into a botnet [1].
According to Google, Videostrong sold access to criminal affiliates and loaded their malware modules onto infected devices. These modules conducted ad fraud, enrolled devices in residential proxy networks and loaded further malware [1]. Google also acted against the command-and-control domains used by the affiliate modules, which it assesses will cut access to at least 10 million additional compromised devices [1].
Google has cut ties with Videostrong and banned it from making devices with preloaded Google apps [1]. Ars Technica reports that the affected boxes were mostly sold under the MECOOL brand, and that Google worked with Japan's National Police Agency, Synthient and Trend Micro [2].
Malwarebytes reports that the takedown disrupted the botnet but the backdoor remains in infected boxes' firmware. It advises users who suspect their box is affected to disconnect it and ask the seller about a fix or replacement [3].
What ATLAS data show
ATLAS fair value figures are model estimates, not promises. For Alphabet, the estimate is $224.80 (range $142.14 to $355.53), and the November 3 closes were 24.52% above that value for GOOGL and 23.80% above for GOOG. For Palo Alto Networks, the estimate is $148.61 (range $114.13 to $197.51), with the close 135.58% above it. For Fortinet, the estimate is $113.36 (range $92.31 to $139.21), with the close 13.01% above it. No ATLAS fair value is shown here for CrowdStrike.
The market reaction will be visible at the close of November 4, and this page will be updated then. Any later coincidence in time between the event and a price is not causality. Data come from closes and may change.
What you get with ATLAS
Fair value of each company, with its range, against today's price.
Chance of a rise in 1 month and the normal price range, from a calibrated model.
Earnings: next date, estimated EPS and surprise history.
Dividends and alerts by email when a company reports.
Google describes it as a backdoor that enrolled more than 1.3 million set-top boxes into a botnet, which it says Videostrong Technology operated for financial gain [1].
Is the backdoor gone from infected boxes?
Malwarebytes reports that the takedown disrupted the botnet but the backdoor remains in infected boxes' firmware [3].
When will the market reaction be visible?
At the close of November 4, the first session that can reflect the event. This page will be updated then.
Closing prices, fair value, probabilities, earnings and dividends: ATLAS own data as of November 4, 2026. How we calculate fair value.
Information, not advice. This content is informational and is not an investment recommendation or an offer to buy or sell securities. ATLAS estimates come from statistical models using public data, can be wrong, and past performance does not guarantee future results. Disclaimer
ATLAS Signals
ATLAS Signals, every week
The week in the market, three stocks on ATLAS’s radar and what comes next. Get it every Monday.
By subscribing you agree to receive ATLAS Signals by email every Monday. You can unsubscribe with one click at any time. Privacy
ATLAS