Google and its partners dismantled the XCPE botnet after Videostrong Technology infected over 1.3 million connected devices. The Shenzhen-based Android manufacturer allegedly embedded a hidden firmware backdoor for financial gain and sold access to criminal affiliates.
Google disclosed the operation on November 2, identifying Android TV boxes and other connected products worldwide. The malware activated after devices’ first boot, allowing operators to install additional tools without owners’ knowledge.
Google traced infections across multiple brands and models over several years, reaching devices in more than 200 countries. Most compromised products included Android TV set-top boxes, telehealth equipment, karaoke machines, and digital signage hardware.
Videostrong allegedly used code obfuscation to evade certification checks before loading malicious components during initial device setup. Google described the campaign as an intentional business operation rather than an isolated security mistake.
The XCPE backdoor gave criminal affiliates access to household networks and connected hardware without users’ permission. Affiliates used infected devices to generate fraudulent advertising views and route traffic through residential internet connections.
Google also discovered modules that installed additional malware, captured screens, recorded keystrokes, and stole account information.
Google coordinated the disruption with Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI. The company pursued legal action against Videostrong’s control servers and domains distributing additional malware modules.
Google also cut ties with Videostrong and barred its affiliates from manufacturing certified Android devices or supplying software.
The operation also targeted command domains used by more than a dozen malware families beyond XCPE. Google estimates these actions could sever access to at least 10 million additional compromised devices.
However, disabling command servers does not necessarily remove malware already embedded inside affected device firmware.
Google’s technical report says the x.cpe backdoor resides in the system partition and can reinstall after removal. A reboot may therefore restore the malicious package, leaving ordinary users without a reliable manual cleanup option.
Google updated its device review process and advised consumers to choose connected products from reputable manufacturers. Owners should install available firmware updates and disconnect suspicious devices from home networks. Devices showing persistent unusual activity may require replacement after consultation with their manufacturers.
Also Read: Google Messages Gets a Fresh Gradient App Icon in New Beta Update