Google said on 2 November that it had dismantled XCPE, a backdoor hidden in the firmware of Android TV set-top boxes that enrolled more than 1.3 million devices in a criminal botnet. Google’s Threat Intelligence Group assesses with high confidence that Videostrong Technology, an Android device maker that produced many of the affected boxes, built and ran the operation for financial gain. Google has banned the company from its certified Android ecosystem and ended its relationship with it.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
Owners had little chance of noticing. The main component runs with system privileges and reinstalls itself from a protected partition after a reboot, so deleting an app does nothing. The 1.3 million figure also counts only boxes tied to this one backdoor: Google estimates that cutting the affiliates’ command domains severs access to at least 10 million more compromised devices infected through other routes, because the affiliates also distributed their modules through other channels. Those devices were infected through other malware families, so a removed backdoor would not by itself clean them.
Details of the takedown come from Google Threat Intelligence Group’s write-up and from Help Net Security’s summary of it. The group’s central finding is that a manufacturer deliberately infected its own customers, which it called an unacceptable breach of trust and a serious risk to those users. It also described backdoor operators, ad-fraud rings and residential proxy providers as an interconnected supply chain.
XCPE in firmware and the Play Protect switch
The malware turns off Google Play Protect by changing the setting that verifies packages, and it erases records of user consent. Operators could take live screenshots, inject keystrokes and open a remote shell. Videostrong used obfuscation to load malicious code after first boot, which slipped past a gap in Google’s testing of certified devices.
The code has moved over time. In late 2024, Videostrong shifted malicious modules out of a package named x.cpe into a separate one called com.abc.nexus, reportedly in response to earlier enforcement tied to BadBox. In August 2026 new dropper packages appeared, synchronized with a mass uninstall of com.abc.nexus, and these droppers pose as system packages and use a privilege escalation exploit to write to the system partition, which makes removal harder.
Affiliates, ad fraud and residential proxies
Google describes Videostrong Technology Co. as both an original equipment manufacturer and an original design manufacturer, meaning it designs hardware and firmware that other brands then sell under their own names. That position let it embed the backdoor before any box reached a shop shelf. Videostrong sold access to compromised boxes to criminal affiliates, who installed their own modules. Those modules ran hidden ad views, enrolled devices in residential proxy networks, stole account details and system logs, and installed further malware. Most infected devices are Android TV set-top boxes, but Google also saw telehealth devices, karaoke machines and digital signage in the botnet.
The pattern echoes earlier cases. Google sued the operators of BadBox 2.0 in New York federal court in July 2025, saying that botnet had infected more than 10 million uncertified devices. A March 2025 account in CE Pro described off-brand, low-cost Android streaming boxes, tablets and projectors, many backdoored during manufacturing and sold worldwide. Connected-TV ad fraud is a separate profit line that SecurityWeek covered in its report on the Pareto botnet, which generated about 650 million ad requests a day by faking streaming-device traffic.
The Videostrong ban and the partners in the takedown
Google took legal action against the domains and servers Videostrong used to control the botnet and deliver modules, and against command infrastructure for more than a dozen malware families spread through the backdoor. It barred Videostrong and any future subsidiaries or affiliates from building or selling certified Android devices or supplying software to certified vendors, ended the relationship, tightened firmware integrity checks for certified Android TV hardware, and changed its manufacturer review process.
Partners in the operation were Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI. Gavin Reid, HUMAN’s chief information security officer, said coordinated action of this kind interrupts the infrastructure needed for monetization, which is the weak point for botnets that earn money from ads and proxy traffic. Taking down servers alone tends to be temporary, so the manufacturer ban and the stricter firmware checks are the parts of the response meant to last.
Google’s consumer guidance is short. It advises caution with apps that pay for unused bandwidth or internet sharing, sticking to trusted app stores, confirming that Play Protect is active, and buying set-top boxes only from manufacturers on its list of certified Android TV partners. Its post offers no step-by-step check for ordinary owners; the package names it lists, including x.cpe, com.oemservice, com.abc.nexus, com.vs.grass, com.android.sso.auth.handler and com.android.system.ntp, are aimed at security teams. No affected box models have been named in the coverage, so owners of unbranded hardware cannot yet tell from the reporting whether theirs is one of the 1.3 million.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Regulators cleared the first U.S. small modular reactor, 4 months early
- Lake Powell sank to a record 3,517 feet, nearing the level that stops Glen Canyon Dam’s turbines
- Seven of Earth’s nine planetary boundaries are breached, and all seven are worsening
- The NSA says three phone features should be off whenever you aren’t using them
