Google dismantles botnet infecting 1.3 million Android devices

Google says it has dismantled XCPE (also known as X[.]CPE), a backdoor and botnet affecting more than 1.3 million Android set‑top boxes. The operation was developed and run by Videostrong Technology, a China‑based OEM/ODM of Android devices. Google states that Videostrong sold access to affiliates and loaded malicious modules on backdoored devices, which were then used for ad fraud, data exfiltration as residential proxies, and to load additional malware.

The company notes the malware was embedded across multiple device models and brands over several years, with a dedicated infrastructure and evolving configurations to evade detection and manage affiliates.

As part of the takedown, Google took action to remove the botnet’s domains and servers, including the command‑and‑control domains behind the additional modules loaded on XCPE bots. Google believes the XCPE operation was deliberate, not the result of an insider or a development flaw, and it banned Videostrong from making devices with pre‑loaded Google apps.

The reported architecture comprises three stages: a primary backdoor persisting on the /oem/ partition, a loader and execution engine, and monetisation modules capable of delivering further backdoors and modules. While most infected devices are Android TV set‑top boxes, Google notes infections also included other Android‑based IoT devices such as telehealth gear, karaoke machines and digital signage.

The disruption involved partners including Japan’s National Police Agency, Lumen, Human Security, Plume, Synthient and TrendAI. Technical details are published by Plume (whitepaper, 2026), Synthient, and TrendAI. Google warned that the global illicit market remains resilient, with backdoor operators and ad‑fraud rings pivoting to new loaders or rival monetisation SDKs after the takedown.