On 2 November 2026, Google announced that it and its partners had disrupted XCPE, a botnet built into the firmware of more than 1.3 million set-top boxes and other Android devices. Google Threat Intelligence Group (GTIG) says it assesses with high confidence that the device maker Videostrong Technology, a China-based Android OEM/ODM, deliberately developed, deployed and ran the backdoor for profit. In GTIG's words, this "wasn't an isolated rogue insider or a development oversight".
How it worked, according to GTIG: the backdoor (x.cpe, called com.oemservice in some builds) sat in the firmware with system privileges and reinstalled itself on reboot if a user removed it. It switched off Google Play Protect app verification and took commands over MQTT: silent app installs, shell commands, screen capture and keystroke injection. Videostrong sold access to criminal affiliates, whose modules turned the boxes into residential proxy exit nodes, ran ad fraud or loaded more backdoors. CyberScoop reports the malicious code loaded only after the first boot, which helped it get past Google's certification tests. Most infected devices were Android TV boxes, but telehealth devices, karaoke machines and digital signs were hit too.
The takedown: Google used legal action against the control domains and servers, and against command servers of more than a dozen malware families delivered through XCPE. Google says this also cuts access to at least 10 million more compromised devices. That figure is separate from the 1.3 million. Partners were Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI. Google has banned Videostrong and any future subsidiaries or affiliates from making certified Android devices or supplying software to certified vendors, and says it has tightened its firmware checks.
Not settled: the Plume release says the devices were in more than 200 countries; TrendAI researchers quoted by CyberScoop say more than 170, with the most in Malaysia, Brazil, Iraq, Mexico and Taiwan, and nearly 44,000 in the US between June and October. Google has not published a list of affected brands or models. Cutting off the servers does not remove the backdoor from the firmware. CyberScoop says it does not know whether Videostrong responded.
