Science & Tech · Cybersecurity · 3 hrs ago
Google disrupts botnet linked to 1.3 million Android devices
Google and partners disrupted the XCPE botnet, which involved more than 1.3 million Android devices, mostly TV boxes.
Google says Chinese device maker Videostrong deliberately built a backdoor into devices during manufacturing and sold criminals access to them.
Criminals used the devices for online ad fraud and residential proxy services, routing other people’s internet traffic through owners’ home connections.
The backdoor could also let operators install apps, run commands and collect information from devices without owners’ knowledge.
Google and its partners, including Japan’s National Police Agency, took down the botnet’s control servers and related domains.
The action also cut off access to at least 10 million other compromised devices, which had been infected through other means.
Google has ended its relationship with Videostrong and barred it from making certified Android devices or supplying software to certified vendors.
The backdoor may remain on affected boxes, and the sources say owners cannot remove it themselves.
Google and industry partners disrupted the XCPE botnet, which affected more than 1.3 million Android devices, mostly TV set-top boxes.
Google says it has high confidence that device maker Videostrong intentionally installed a backdoor and sold criminals access to infected devices.
The devices were used for ad fraud, residential proxy services and other malicious activity.
Google took down the botnet’s control servers and says the action also cut off access to at least 10 million other compromised devices.
Google ended its relationship with Videostrong and barred the company and its future affiliates from making certified Android devices or supplying software to certified vendors.
- Who
- Google and industry partners disrupted the botnet; Google attributes it with high confidence to Videostrong Technology Co.
- What
- The XCPE Android botnet was disrupted, and Google cut ties with Videostrong and barred it from certified Android activities.
- When
- The takedown occurred in late October 2026.
- Where
- The botnet infected Android devices, mostly TV set-top boxes, across multiple countries. Videostrong is based in Shenzhen, China.
- Why
- Google says Videostrong deliberately installed a backdoor and sold access for financial gain; criminals used infected devices for ad fraud and proxy services.
This story does not have two clearly opposing sides.
Google led a takedown that cut off control of the XCPE botnet's servers.
BleepingComputer and The Hacker News published reports on the disruption.
- Infected devices
- More than 1.3 million Android devices
- Additional compromised devices affected
- At least 10 million
- Device maker named by Google
- Videostrong Technology Co.
- Devices counted by TrendAI
- 1,472,554 across 206 models
- Partners
- Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI
3 sources
What people are saying
We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.
We found this malicious software built directly into many different device models and brands over multiple years, supported by dedicated infrastructure and constantly evolving configurations to evade detection and manage their affiliates.