Google Dismantles XCPE Botnet Infecting 1.3 Million Android TV Boxes
Google Dismantles Factory-Installed XCPE Botnet
Google has dismantled the XCPE botnet, an operation that compromised more than 1.3 million Android devices worldwide through backdoors injected directly during factory production by Chinese manufacturer Videostrong. Investigators from the Google Threat Intelligence Group (GTIG) traced the malicious firmware directly back to Videostrong, a hardware maker based in Shenzhen, after the Mountain View tech giant seized control of the servers steering the criminal network in a coordinated takedown alongside the Japanese National Police and multiple cybersecurity firms. Google and its partners, including the National Police Agency of Japan and companies such as HUMAN Security and TrendAI, have announced the dismantling of the XCPE botnet, which was accused of having intentionally developed, deployed, and operated this system for profit by integrating the malware into the firmware of devices before their commercialization.
Videostrong Baked Malicious Software into Device Firmware
The malicious software, identified in code as x.cpe and com.oemservice, was baked straight into the device firmware before sale. Because the backdoor held elevated system privileges, users who attempted to remove it found that it simply reinstalled itself automatically upon reboot.
Residential proxies, ad fraud, and credential theft have flourished through sophisticated pre-infected device schemes. This research, in partnership with the @motionpictures and in collaboration with @Google, @trendaisecurity , @BlackLotusLabs , and @SecureWithHUMAN, disrupts…
These low-cost Android TV boxes are sold globally for a fraction of the cost of premium hardware, making them popular budget choices. To secure Android TV certification, manufacturers must clear security checks. Videostrong bypassed these hurdles by obscuring its code and loading malicious elements only after the initial device boot-up, a method recognized by Google, which has corrected its review procedure.
Once connected to the internet, the infected boxes disabled Google Play Protect, enabling unauthorized app installations, silent command execution, screenshots, and credential theft.
Monetization and Global Scale of Infections
The botnet consisted of more than 1.3 million Android TV boxes spread across more than 200 countries, with researchers from TrendAI recording nearly 1.5 million infected devices across 206 models between June and October. Variants of the backdoor turned up in telemedicine hardware, karaoke machines, and digital signage displays.
Videostrong allegedly monetized the botnet by selling backdoor access to third-party affiliates. The network repurposed compromised homes into residential proxies via services like Linkfog, AppSalt/Honeygain, and NetNut, allowing outside actors to route illicit web traffic through residential connections. Other modules engaged in large-scale ad fraud by generating automated impressions on hidden online advertisements.
In addition to shutting down the command-and-control servers, court-approved actions cut off access for at least 10 million additional devices infected by other operators sharing the same infrastructure, and Google has also cut the servers that piloted 1.3 million of them infected before leaving the factory.
Google Revokes Certification as Hardware Vulnerabilities Persist
Google severed all ties with Videostrong, revoking its Android TV certification rights and barring the company and its subsidiaries from supplying software to other approved partners.
While the court-sanctioned takedown rendered the botnet inoperable, the underlying x.cpe code remains embedded on sold hardware because Google’s server seizure could not wipe the firmware clean locally. Eliminating the backdoor entirely requires flashing a clean firmware build or keeping the hardware permanently disconnected from the internet. Videostrong is known for its brand MECOOL, and in parallel, the firm from Mountain View is seeking to relax Android’s Advanced Protection, its strictest software lock.
Google has not publicly released a full breakdown of the specific model numbers or infection totals per country, leaving affected consumers to identify vulnerable hardware independently as the company overhauls its device verification pipelines.
Other Detected Malware and Additional Compromised Devices
The reporting also notes Triada, a virus found in the firmware of thousands of counterfeit smartphones, as well as Keenadu, malware hidden in the firmware of more than 13,000 low-cost Chinese smartphones and tablets available on Amazon or AliExpress.
Google disrupts million-device XCPE Android malware botnet, bans TV box makerhttps://t.co/aymcNWsHl2https://t.co/aymcNWsHl2