Shutting the Door on the XCPE Botnet

The XCPE botnet was a large-scale malware operation involving over 1.3 million set-top boxes infected with a backdoor developed and operated by Videostrong Technology Co., an Android device manufacturer. The backdoor enabled criminal affiliates to conduct ad-fraud, create residential proxy networks, and install additional malware. The botnet infrastructure spanned multiple years and device models. Google and industry partners dismantled the botnet, banned Videostrong from Android certification, and improved firmware integrity reviews for Android TV devices to prevent recurrence.

• The phone was compromised before the user turned it on: the rise of Midnight MimosaMalware2026-10-12
• Black October for AI Developer PlatformsCampaign2026-10-31
• Securing Internet-Critical Software: How We Could Have Backdoored BashNews2026-11-02
• Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens StumblesMalware2026-10-26
• Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits EmergeBotnet2026-10-23