BotnetPublished 3 Nov 2026

Google Dismantles XCPE Botnet of 1.3 Million Android Devices

Source SecurityWeek

Description

Google dismantled the XCPE botnet, which infected over 1.3 million Android devices, primarily Android TV set-top boxes, but also other IoT devices. The botnet was created and operated by Videostrong Technology, an Android OEM/ODM, for financial gain through ad fraud, data exfiltration, and use as residential proxies. The malware was pre-installed on devices, evading Google's security tests via obfuscation and persisted through a multi-stage architecture. Google took legal action to seize the botnet's infrastructure, disrupting operations and severing access to millions of devices. Videostrong was banned from preloading Google apps due to this deliberate malicious activity.

Impact

The botnet compromised over 1.3 million Android devices, enabling financial crimes such as ad fraud and data exfiltration. Infected devices were used as residential proxies and to load additional malware, posing significant privacy and security risks. The malware's persistence and obfuscation allowed it to evade detection and operate for years, affecting a wide range of Android-based IoT devices. The operation's scale and sophistication indicate a deliberate, organized effort by Videostrong, undermining trust in affected devices and potentially exposing users to ongoing exploitation until the takedown.

Defensive guidance

Google has dismantled the XCPE botnet infrastructure and taken legal action to seize control of the botnet's domains and servers. Videostrong Technology has been banned from preloading Google apps on devices. Users should ensure their devices receive updates from legitimate vendors and avoid devices from untrusted manufacturers. Since the botnet was pre-installed by the OEM, remediation may require device replacement or factory resets with verified firmware. No further immediate action is required from end users beyond following vendor guidance and updates.

Summary

The XCPE botnet was a large-scale malicious operation involving over 1.3 million Android devices infected with a backdoor pre-installed by Videostrong Technology, a China-based OEM/ODM. The malware included a persistent backdoor on the /oem/ partition, a loader, and monetization modules that allowed affiliates to exploit infected devices for ad fraud, data theft, and proxy services. Google discovered that Videostrong used obfuscation techniques to bypass compatibility and security tests, enabling the malware to load after the device's first boot. The botnet affected multiple device types beyond Android TV boxes, including telehealth devices and digital signage. Google dismantled the botnet by legally taking down command-and-control domains and servers, with assistance from international partners. This disruption impacted not only XCPE but also related malware modules affecting an estimated 10 million devices. Google banned Videostrong from preloading Google apps as a consequence of this deliberate malicious conduct.

References

securityweek.com/google-dismantles-xcpe-botnet-of-1-3-million-android-devices/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 3 Nov 2026, 09:28 UTC

Technical details

References

Community reviews

Related threats