GoKawiilGoogle dismantles XCPE botnet, bans Videostrong from Android TV certification
Google and industry partners took down the XCPE malware botnet, which infected over 1.3 million Android TV streaming boxes made by China-based Videostrong Technology. Google says Videostrong deliberately built a persistent backdoor into its devices and sold access to criminal groups, who used the devices for ad fraud, residential proxy networks, and further malware installation. Google also shut down command-and-control servers tied to more than a dozen related malware families affecting over 10 million additional devices, including set-top boxes, karaoke machines, and telehealth hardware.
GoKawiil's interpretation of the reporting above, not reported fact.
The case highlights how hardware supply chains, not just software vulnerabilities, can be exploited for large-scale cybercrime, since Google says the backdoor was built in at manufacture rather than discovered later. By revoking Videostrong's Android certification and barring future affiliates, Google appears to be signaling it will police device makers more aggressively, which could pressure other manufacturers in the certified Android ecosystem. The involvement of multiple security firms and a national police agency suggests this type of coordinated takedown may become a template for addressing manufacturer-embedded malware.
- Google attributes intentional backdoor creation to Videostrong Technology Co. for financial gain via cybercrime.
- Over 1.3 million devices were part of XCPE; a broader takedown affected more than 10 million additional compromised devices.
- Google revoked Videostrong's license to make certified Android TV devices and banned future affiliated manufacturing.
NVIDIA Shield TV Pro — Given this story about counterfeit, malware-laden Android TV boxes, it's worth switching to a trusted, Play Protect-certified streaming device instead. The NVIDIA Shield TV Pro runs official Android TV software with regular security updates, so you avoid the shady firmware risks highlighted in the Videostrong botnet case while still getting a powerful streaming and gaming experience.
See NVIDIA Shield TV Pro on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-11-02
Published there as: “Google disrupts million-device XCPE Android malware botnet, bans TV box maker”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.