Google Dismantles 1.3 Million-Device XCPE Botnet, Bans Videostrong Over Android TV Malware
Updated
Updated · Google Cloud · Nov 2
Google Dismantles 1.3 Million-Device XCPE Botnet, Bans Videostrong Over Android TV Malware
3 articles · Updated · Google Cloud · Nov 2
Summary
More than 1.3 million Android-based devices—mostly TV set-top boxes—were enrolled in the XCPE botnet that Google and partners say Videostrong intentionally built and ran for profit.
Google said the preloaded x.cpe backdoor gave system-level access, reinstalled itself after removal, disabled Play Protect, and let operators push modules for ad fraud, residential proxies, data theft and remote shell commands.
Legal takedowns hit Videostrong’s command-and-control servers and affiliate malware domains; Google said severing those channels should also cut access to at least 10 million additional compromised devices beyond XCPE.
Videostrong has been banned from building certified Android devices or supplying software to certified vendors, while Google tightened Android TV firmware and review checks after saying the malware exploited a testing gap.
Google said the case shows a broader criminal supply chain linking hardware makers, proxy networks and ad-fraud operators, with infected devices also found in telehealth, karaoke and digital-signage products.
Will Google's permanent ban on Videostrong stop supply chain attacks, or simply push malicious manufacturers deeper into the unregulated shadow market?
How can everyday consumers detect a hidden firmware backdoor if standard security apps and factory resets are completely useless against it?
With millions of compromised devices acting as legitimate home IPs, how can corporate networks defend against threats hiding in plain sight?
1.3 Million Android TV Devices Compromised: The XCPE Botnet, Videostrong’s Role, and the Global Supply Chain Crisis
Overview
In October 2026, Google and international partners dismantled the XCPE botnet, which infected over a million set-top boxes worldwide. The root cause was traced to Videostrong Technology, which intentionally pre-installed the x.cpe backdoor into device firmware and designed it to activate only after reaching customers, bypassing Google’s security checks. Criminal affiliates then used these compromised devices for monetization schemes, such as turning them into residential proxy exit nodes, exposing owners to legal risks. Although the takedown severed control servers and made the botnet dormant, the persistent backdoor remains in devices, leaving replacement or strict network isolation as the only effective remedies.