Google's Threat Intelligence Group worked with industry partners to take down a botnet, dubbed XCPE, built from more than 1.3 million Android TV set-top boxes. Investigators traced the malware to Videostrong Technology Co., a Chinese manufacturer accused of preloading devices with backdoors that resold users' internet connections through residential proxy services and enabled advertising fraud. Google took legal action to seize the domains and servers used to control the botnet.
krebsonsecurity.com
· 2026-11-03
Google says Shenzhen-based manufacturer Videostrong Technology built a hidden backdoor into roughly 1.3 million Android devices, mostly set-top boxes but also telehealth gear, karaoke machines and digital signage. Google says it dismantled the backdoor, disrupted related command-and-control domains, and banned Videostrong from building or selling certified Android devices or software.
theverge.com
· 2026-11-02
Researchers report that attackers are actively exploiting a chain of recently patched Plex Media Server vulnerabilities, dubbed 'Plex2Shell,' to achieve remote code execution on unpatched devices. A honeypot set up to monitor the activity recorded scanning within a day and subsequent successful infections that install cryptomining software and residential proxy applications.
arstechnica.com
· 2026-10-19
Security researchers at Bitdefender say firmware on low-cost Android devices using MediaTek chipsets has been shipping with malware that grants system-level control, enabling silent app installs, ad fraud, and turning phones into residential proxies. The campaign has affected thousands of devices across more than 150 countries over roughly two years, hitting models from Doogee and Cubot as well as phones impersonating Samsung and Apple products.
bleepingcomputer.com
· 2026-10-08
GoKawiil