Google disrupts XCPE Android TV botnet tied to Videostrong
Original title: Google disrupts XCPE botnet, bans the company behind it
Google says more than 1.3 million set-top boxes carried the firmware backdoor and affiliate takedowns reach at least 10 million other devices.
Google’s Threat Intelligence Group said it shut down servers behind XCPE, a backdoor in Android TV set-top box firmware, and attributes the operation with high confidence to manufacturer Videostrong Technology. Researchers say the company sold access to criminal affiliates, whose modules served hidden ads, residential proxies, account and log theft, further malware, screenshots, keystrokes and shells. The main component has system privileges and reinstalls from a protected partition. Google sued infrastructure, banned the company from certified Android work, and tightened Android TV firmware checks.
Unconfirmed: Google’s high-confidence attribution of XCPE to Videostrong is the company’s assessment.
- Since August 2026, droppers posed as system packages and used a privilege-escalation exploit.
- The malware disables Google Play Protect and clears records of user agreements.
- Other infected Android IoT gear included telehealth, karaoke and digital signage devices.
- Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI assisted.
Impact: Remote control, data theft, ad fraud and proxy abuse on devices
| Product | Affected |
|---|---|
| Videostrong Technology Android TV set-top boxes | — |
- 1.Do not rely on deleting the app; XCPE reinstalls from a protected partition.
- ATT&CK
- T1068 Exploitation for Privilege EscalationT1562.001 Impair Defenses: Disable or Modify ToolsT1113 Screen CaptureT1056.001 Input Capture: KeyloggingT1059 Command and Scripting Interpreter
- Vendors
- Videostrong TechnologyGoogle
- Products
- Android TV
- Malware
- XCPE
From the original article
2 min read at helpnetsecurity.com
Google shut down the servers behind XCPE, a backdoor hidden in the firmware of Android TV set-top boxes. Google’s Threat Intelligence Group attributes the operation with high confidence to Videostrong Technology, the company that manufactured many of those boxes. More than 1.
By Mirko Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.