Google Disrupts XCPE Botnet on 1.3 Million Android Devices
November 2, 2026: CyberScoop reports the botnet spanned over 170 countries, affected telehealth, karaoke and digital signage devices from multiple manufacturers and that Google took legal action against domains and servers.
Google and partners dismantled the XCPE botnet infecting over 1.3 million Android TV set-top boxes, banned Videostrong from certification after it sold access to criminal affiliates.
Google Threat Intelligence and partners disrupted the XCPE backdoor in Android TV set-top box firmware, attributing the persistent malware to Shenzhen-based Videostrong Technology Co. The backdoor enrolled more than 1.3 million devices into a botnet for ad fraud, residential proxies and additional malware, with affiliates loading modules without user knowledge. Google banned Videostrong from certified Android devices, disrupted C2 domains affecting at least 10 million more and worked with Japan's National Police Agency along with security firms including TrendAI, Lumen, HUMAN Security, Plume and Synthient. The malware disabled Google Play Protect, cleared user agreements and required vendor action to remove.
- Over 1.3 million Android TV set-top boxes infected with XCPE backdoor
- Videostrong banned from Android certification and firmware checks
- C2 disruption affects at least 10 million additional devices
- Used for ad fraud, proxies and data theft by criminal affiliates
- Partners include Japan's National Police Agency and TrendAI
- Spanned 170 countries with devices from multiple manufacturers
Timeline
dated events in the reporting · oldest first- Jun 3, 2026TrendAI begins logging more than 3.8 million distinct IP addresses connected to the operation · The Register
- Aug 1, 2026Droppers pose as system packages and use privilege-escalation exploit · Help Net Security
- Oct 1, 2026TrendAI stops logging IP addresses connected to the botnet · The Register
- Nov 2, 2026Google disrupts XCPE botnet and bans Videostrong from Android certification · Google Threat Intelligence
What each outlet adds
beyond the shared facts- CyberScoopReports botnet spanned 170 countries with Malaysia and Brazil largest; affected multiple device types
- BleepingComputer1.47 million infected devices tracked by TrendAI across 206 models; backdoor still present in firmware
- Help Net SecurityMalware disables Google Play Protect and clears user agreements; privilege-escalation exploit since August
- The Register3.8 million distinct IP addresses documented; backdoor sold to criminal affiliates
- Google Threat IntelligenceCoordinated takedown with Japan's National Police Agency and security firms
Coverage
oldest first · one row per article · UTC- · 10h ago
Google Threat IntelligenceFirst report
Google dismantles XCPE botnet operated by Videostrong
Google banned Videostrong from Android devices after 1.3 million set-top boxes enrolled in the botnet.
- · 8h ago
The Hacker News
Google disrupts 1.3 million-device Android botnet with Videostrong backdoor
Google and partners took down a botnet of 1.3 million Android TV boxes containing a persistent backdoor sold by device maker Videostrong.
- · 8h ago
Help Net Security
Google disrupts XCPE Android TV botnet tied to Videostrong
Google says more than 1.3 million set-top boxes carried the firmware backdoor and affiliate takedowns reach at least 10 million other devices.
- · 5h ago
BleepingComputer
Google disrupts million-device XCPE Android malware botnet, bans TV box maker
Google dismantles XCPE botnet of 1.3 million devices and bans Videostrong Technology Co for intentional malware installation.
- · 5h ago
The Register · Security
Videostrong backdoor powers 1.3M Android TV box botnet
Coalition disrupts XCPE backdoor in Videostrong devices infecting 1.3M Android boxes across 200 countries.
- · 2h ago
CyberScoop
Google shuts down XCPE botnet on Android devices
Google dismantled the XCPE botnet infecting over 1.3 million Android devices sold by Videostrong after it evaded security checks.