Skip to content
NewA calmer, faster ZeroHour
StoryMalwarehighExploited in the wild

Google Disrupts XCPE Botnet of 1.3 Million Android Devices

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Google and partners dismantled an XCPE botnet infecting over 1.3 million Android TV boxes and other devices, attributing the firmware backdoor to Videostrong Technology which was banned from Android certification.

Google Threat Intelligence Group and partners disrupted the XCPE botnet, a persistent backdoor installed by Videostrong Technology Co. in Android firmware. The backdoor enabled ad fraud, residential proxies, data theft and further malware on infected devices. It affected over 1.3 million set-top boxes and other IoT gear across multiple years, with potential impact on at least 10 million additional systems. Videostrong was banned from Android certification and preloading Google apps, with C2 infrastructure taken down.

Key facts
  • Over 1.3 million Android devices infected across 206 models
  • x.cpe firmware backdoor installed by Videostrong Technology Co
  • Banned Videostrong from certified Android device production
  • Malware used for ad fraud, proxies and additional implants
  • Affected devices include telehealth, karaoke and digital signage
  • Coordinated with Japan's National Police Agency and security firms
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Nov 2, 2026Google disrupts XCPE botnet, bans Videostrong · Help Net Security

What each outlet adds

beyond the shared facts
  • The Hacker News1.47 million infected devices tracked by TrendAI across 206 models
  • Help Net SecuritySince August 2026 droppers used privilege-escalation exploit
  • BleepingComputerCoordinated with Japan's National Police Agency and security firms
  • SecurityWeekMalware loaded on various Android device models over multiple years
  • Dark ReadingUpdates to malware in 2024 and 2026
Vendors
GoogleTrendAIHumanSynthientVideostrong Technology Co.Videostrong TechnologyVideostrong Technology CoVideostrongTrend Micro
Products
AndroidAndroid TV set-top boxesAndroid TV streaming boxesAndroid TV boxesAndroid TVAndroid devicesAndroid set-top boxesAndroid-based IoT devicesMECOOL
Threat actors
VideostrongVideostrong Technology Co.Videostrong Technology CoVideostrong Technology
Malware
XCPEcom.abc.nexuscom.oemservicemalware modulesx.cpe network
Victims
Android TV set-top boxesAndroid device usersusers of Android TV boxes
Organizations
GoogleNational Police AgencyLumenHUMAN SecurityPlumeSynthientTrendAIGoogle Threat Intelligence GroupJapan’s National Police AgencyHuman Security
Countries
JapanChinaMalaysiaBrazilIraqMexicoTaiwan

Coverage

oldest first · one row per article · UTC
  1. · 9d ago The Hacker NewsFirst report

    Google disrupts 1.3 million-device Android botnet with Videostrong backdoor

    Google and partners took down a botnet of 1.3 million Android TV boxes containing a persistent backdoor sold by device maker Videostrong.

  2. · 9d ago Help Net Security

    Google disrupts XCPE Android TV botnet tied to Videostrong

    Google says more than 1.3 million set-top boxes carried the firmware backdoor and affiliate takedowns reach at least 10 million other devices.