Summary
Google Threat Intelligence says it and industry partners disrupted the XCPE botnet, which had enrolled more than 1.3 million set-top boxes. Google attributes the backdoor to Android device maker Videostrong and says it has cut ties with the company.
Google Threat Intelligence said on November 3, 2026, that it and industry partners had disrupted the XCPE backdoor and botnet, which had enrolled more than 1.3 million set-top boxes. Google assesses with high confidence that Videostrong Technology Co., an Android original equipment manufacturer and original design manufacturer, developed and operated the malware for financial gain.
Google says Videostrong sold criminal affiliates access to infected devices and loaded their software onto them. The modules carried out ad fraud, turned devices into residential proxy nodes and installed further malware. Google has cut ties with Videostrong and barred it and its future subsidiaries or affiliates from making certified Android devices or supplying software to other certified vendors.
How the backdoor controlled infected devices
XCPE was embedded in device firmware rather than installed as an ordinary app. Google’s analysis describes a component called x.cpe, also found under the package name com.oemservice, running with Android system-level privileges. If removed from the app data area, it could reinstall itself after a reboot from the device’s OEM partition, helping it persist.
The backdoor contacted command-and-control infrastructure to receive configuration and instructions. It used MQTT, a lightweight messaging protocol, for persistent communications with operators. Google says those operators could direct silent app installations, run shell commands and scripts, and capture screens. The company also reports observing the collection and transmission of device information, account information, app inventories and system logs.
A separate loader, com.abc.nexus, commonly handled the execution of monetisation modules. These could route outside traffic through a device’s residential internet connection, generate fraudulent ad activity or load additional backdoors. Residential proxy services can have legitimate uses, but enrolling a device without its owner’s knowledge turns its internet connection into infrastructure controlled by others. That can expose the device and its network to unwanted activity while making the traffic appear to come from the household connection.
Google says the botnet included Android TV boxes as well as some other Android-based devices, including telehealth devices, karaoke machines and digital signage. The report describes the botnet as globally distributed.
Disruption and changes to Google’s review process
Google and its partners, including Japan’s National Police Agency and several security companies, targeted infrastructure used to control the botnet and distribute affiliate malware. Google also took legal action to take down Videostrong’s control domains and servers, and command-and-control domains used by more than a dozen malware families delivered through the backdoor.
The botnet’s direct reach and the broader disruption estimate refer to different groups of devices. Google says XCPE had enrolled more than 1.3 million set-top boxes. Because the affiliate modules also had other distribution channels, Google estimates that disrupting their command-and-control domains will sever access to at least 10 million additional compromised devices.
Google says Videostrong exploited a gap in its Android compatibility and security review process by loading malicious code after a device’s first boot. The company says it has changed that review process to better protect firmware integrity on certified Android TV devices. The incident illustrates a supply-chain risk: security checks before release may be insufficient if a device can add persistent system software later in its setup or operation.
Google describes the botnet counts, technical findings and attribution as its threat-intelligence assessments. It says the disruption is expected to affect the criminal operations, while warning that operators can shift to other loaders and monetisation services.