Skip to content
NewA calmer, faster ZeroHour
StoryMalwarehighExploited in the wild

Google dismantles XCPE botnet on 1.3 million Android boxes

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Google and partners disrupted the XCPE botnet on more than 1.3 million Android devices and banned Videostrong from certification.

Google and partners disrupted the XCPE botnet, a firmware-level backdoor preinstalled by Videostrong Technology on more than 1.3 million Android TV set-top boxes and other Android IoT devices, including telehealth gear, karaoke machines and digital signage. The backdoor, also called x.cpe or com.oemservice, ran with system privileges, reinstalled from the OEM partition, and was used for ad fraud, residential proxies and further malware sold to affiliates. Google took legal action against control domains and servers, banned Videostrong from Android certification and preloading Google apps, and worked with Japan's National Police Agency and security firms. Most outlets cite more than 1.3 million boxes; Ars Technica reports Trend Micro counted 1.47 million. Several outlets say the disruption also severed access involving at least 10 million other devices. Malwarebytes says the backdoor remains in infected firmware.

Key facts
  • XCPE, also x.cpe or com.oemservice, was preloaded and ran as android.uid.system.
  • More than 1.3 million boxes across 206 models; Trend Micro counted 1.47 million.
  • Uses included ad fraud, residential proxies such as AppSalt and Linkfog, and extra malware.
  • Google banned Videostrong from certified devices and preloading Google apps.
  • Partners included Japan's National Police Agency, Synthient, Lumen, Human Security, Plume and TrendAI.
  • MQTT control used ports 3885-3887; an uninstalled backdoor reinstalls from /oem/.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

What each outlet adds

beyond the shared facts
  • Cyber Security NewsMQTT control on ports 3885-3887 and 10 million additional systems.
  • GBHackersInfection spanned 206 models; Japan's National Police Agency cooperated.
  • Ars TechnicaTrend Micro counted 1.47 million; Play Protect disabled on MECOOL boxes.
  • Malwarebytes LabsBackdoor persists in /oem and remains after the takedown.
  • The RecordMalware updates in 2024 and 2026; devices across over 200 countries.
Vendors
GoogleTrendAIHumanSynthientVideostrong Technology Co.Videostrong TechnologyVideostrongTrend Micro
Products
AndroidAndroid TV set-top boxesAndroid devicesAndroid set-top boxesAndroid-based IoT devicesAndroid TV boxesMECOOL
Threat actors
VideostrongVideostrong Technology Co.Videostrong Technology
Malware
XCPEcom.abc.nexuscom.oemservicemalware modulesx.cpe network
Victims
Android TV set-top boxesAndroid device usersusers of Android TV boxesend users of set-top boxes
Organizations
GoogleNational Police AgencyLumenHUMAN SecurityPlumeSynthientTrendAIGoogle Threat Intelligence GroupJapan’s National Police AgencyHuman Security
Countries
JapanChinaMalaysiaBrazilIraqMexicoTaiwan

Coverage

oldest first · one row per article · UTC
  1. · 8d ago Krebs on SecurityFirst report

    Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies

    Google severed ties with Videostrong after its malware turned 1.3M Android devices into residential proxies for criminals.

  2. · 8d ago Cyber Security News

    Google Dismantles 1.3 Million Device XCPE Botnet

    Google banned Videostrong Technology for preinstalled malware in 1.3M Android devices that also impacted over 10M additional systems.