# XCPE Published articles for XCPE. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Week in review: Refrigeration cyberattacks hit European retailers again, Patch Tuesday forecast DevFeed: [Week in review: Refrigeration cyberattacks hit European retailers again, Patch Tuesday forecast]() Original publisher: [Read original article]() Author: Help Net Security Published: 2026-11-08T09:00:21Z Content type: news Language: en Sources: [Help Net Security]() Topics: [ai-assisted attacks](), [AI Bots](), [shadow AI](), [human review]() Tags: [ai](), [ai-coding-agents](), [botnet](), [cyberattacks](), [google](), [news](), [patch-tuesday](), [refrigeration](), [week-in-review](), [xcpe]() ### AI overview The roundup reports a second wave of cyberattacks on European supermarkets that disrupted refrigeration and spoiled food, following a similar French incident three weeks earlier. A joint US agency advisory also warns that attackers are targeting refrigeration controllers protecting food and medicine, potentially forcing continuous heating and defrost cycles. Other concrete findings include Google's disruption of the XCPE Android TV backdoor botnet, which had enrolled more than 1.3 million devices; a poisoned cPGuard update reaching nearly 3,000 web hosting servers; and exploitation of vulnerabilities in Ivanti Connect Secure, Node-RED, and OpenSSH. The roundup also covers AI agent security: researchers observed coding agents selecting an archived, unmaintained MCP package, while one espionage group reportedly used AI agents in attacks on more than 200 organizations in 11 days. It includes product and research news, interviews, and a Patch Tuesday forecast; the source is a compilation of brief reports, not detailed coverage of each item. ### Source excerpt Here's an overview of some of last week's most interesting news, articles, interviews and videos: The first ten lines of a command policy for AI coding agents In this Help Net Security interview, Vinay Thakker, CTO of KloudStax, explains how to set identity, credentials, and network limits for AI agents. He argues that agents should run under their own identity, with the person's identity attached when acting on someone's behalf. Google disrupts XCPE botnet, bans ... More -> The post Week in review: Refrigeration cyberattacks hit European retailers again, Patch Tuesday forecast appeared first on Help Net Security. ## 1.3 million Google-certified Android TV boxes found to have malware DevFeed: [1.3 million Google-certified Android TV boxes found to have malware]() Original publisher: [Read original article]() Author: Jean-Luc Aufranc (CNXSoft) Published: 2026-11-04T03:52:05Z Content type: news Language: en Sources: [CNX Software - Embedded Systems News]() Topics: [Malware](), [IoT botnets](), [Android Security](), [Android](), [Embedded Systems]() Tags: [ad-fraud](), [affiliates](), [amlogic](), [android](), [android-tv](), [backdoor](), [botnet](), [c2](), [disrupt](), [google](), [hack](), [hardware](), [malware](), [mecool](), [realtek-rtd](), [residential-proxy](), [security](), [tv-box](), [videostrong](), [xcpe](), [xcpe-botnet]() ### AI overview Google reported that 1.3 million Android TV boxes were infected with the XCPE backdoor and used in a botnet for financial gain. It assesses with high confidence that Videostrong Technology developed and operated the backdoor, which could reinstall after reboot. A loader enabled affiliate modules for residential proxy networks, ad fraud, and other monetization. Google disrupted the command-and-control domains and cut ties with Videostrong, ending its ability to preload Google apps or obtain certification. The malware evaded security testing by using obfuscation and loading malicious code after first boot; Google says it has changed its review process. Because the backdoor remains in device firmware, the article says removal requires flashing custom firmware, if available. It identifies Videostrong and MECOOL devices as likely affected, while noting that impact varies by country. ### Source excerpt You might assume that a Google-certified Android TV box will both work better and guarantee no malware. However, you'd be wrong, at least for the latter. Google has just published a new Threat Intelligence report entitled "Shutting the Door on the XCPE Botnet", where they found that 1.3 million TV boxes were infected by the XCPE backdoor, enrolling them into a botnet used for financial gains. Google assesses with high confidence that the malware was intentionally developed, deployed, and operated by Videostrong Technology, a TV box manufacturer, which we frequently covered in the past when Android TV boxes were still somewhat a novelty and at times usable as an alternative to SBCs running Linux. Videostrong apparently monetized the backdoor by allowing affiliates to load malware modules onto infected devices to run ad-fraud schemes, enroll the TV boxes in residential proxy networks, and so on. Google took legal action to disrupt [...] The post 1.3 million Google-certified Android TV boxes found to have malware appeared first on CNX Software - Embedded Systems News. ## Google Dismantles XCPE Botnet of 1.3 Million Android Devices DevFeed: [Google Dismantles XCPE Botnet of 1.3 Million Android Devices]() Original publisher: [Read original article]() Author: Ionut Arghire Published: 2026-11-03T09:22:09Z Content type: news Language: en Sources: [SecurityWeek]() Topics: [IoT botnets](), [Android Security](), [Google]() Tags: [ad-fraud](), [affiliates](), [android](), [android-tv](), [backdoor](), [backdoors](), [botnet](), [china](), [command-and-control](), [data-exfiltration](), [devices](), [digital-signage](), [disrupted](), [featured](), [google](), [iot](), [japan](), [karaoke](), [malware-threats](), [odm](), [oem](), [takedown](), [xcpe](), [xcpe-botnet]() ### AI overview Google dismantled XCPE, a botnet of more than 1.3 million Android devices that it says Videostrong Technology deliberately built into multiple device models and operated for financial gain. Its three-stage malware persisted on the /oem/ partition, then loaded modules used for ad fraud, data exfiltration, residential proxy services, and additional malware. Videostrong sold affiliates access to infected devices. Google says obfuscation let the company load malicious code after first boot, exploiting a gap in its compatibility and security tests; Google has banned Videostrong from making devices with preloaded Google apps. Legal action targeted XCPE's domains and servers and command-and-control domains for other modules, likely severing access to at least 10 million additional devices. Google says the disruption affected over a dozen malicious actors, but the interconnected illicit market can adapt by switching loaders or monetization SDKs. Infected devices included Android TV boxes and some telehealth, karaoke, and digital signage devices. ### Source excerpt The botnet was created and operated for financial gain by Android OEM/ODM Videostrong Technology. The post Google Dismantles XCPE Botnet of 1.3 Million Android Devices appeared first on SecurityWeek. ## Google disrupts million-device XCPE Android malware botnet, bans TV box maker DevFeed: [Google disrupts million-device XCPE Android malware botnet, bans TV box maker]() Original publisher: [Read original article]() Author: Lawrence Abrams Published: 2026-11-02T18:16:34Z Content type: news Language: en Sources: [BleepingComputer]() Topics: [Malware](), [IoT botnets](), [Remote Access Trojan](), [Android Security](), [Android](), [Google](), [google play protect]() Tags: [ad-fraud](), [android](), [android-malware](), [botnet](), [computer-help](), [computer-security](), [computers](), [device](), [disruption](), [google](), [infosec](), [infosec-computer-security](), [linux](), [mac](), [malware](), [malware-removal](), [proxy](), [security](), [spyware](), [support](), [tech-support](), [technical-support](), [tv](), [virus](), [virus-removal](), [windows](), [xcpe]() ### AI overview Google and industry partners disrupted the XCPE botnet, which Google says Videostrong intentionally embedded in more than 1.3 million Android TV boxes for financial gain. The system-level backdoor contacted command servers over MQTT, enabling remote commands, additional malware installation, ad fraud, and use of infected devices as residential proxies. Google also took down servers used by related malware families, cutting off access to at least 10 million more compromised devices, some non-Android. Google terminated Videostrong's relationship and revoked its Android TV manufacturing license. Google and Synthient cite evidence linking the operation to the manufacturer, including malware found on a MECOOL box, company email addresses used to sign backdoors, and infrastructure overlaps. The disruption did not remove malware from infected devices: the excerpt says it can reinstall from the /oem/ partition. It says affected users need clean firmware to remove it or must disconnect devices from the internet to prevent further activity. ### Source excerpt Google and industry partners have dismantled the XCPE malware botnet consisting of more than 1.3 million Android TV streaming TV boxes that Google says its manufacturer intentionally infected with malware to generate revenue through cybercrime activities. [...] ## Google disrupts XCPE botnet, bans the company behind it DevFeed: [Google disrupts XCPE botnet, bans the company behind it]() Original publisher: [Read original article]() Author: Mirko Zorz Published: 2026-11-02T15:50:46Z Content type: news Language: en Sources: [Help Net Security]() Topics: [Cybercrime](), [Android Security](), [Google](), [google play protect]() Tags: [1-3](), [affiliates](), [android](), [android-tv](), [backdoor](), [botnet](), [business](), [company](), [confidence](), [criminal](), [customers](), [cybercrime](), [devices](), [don-t-miss](), [firmware](), [google](), [google-s](), [hardware](), [hidden](), [intelligence](), [internet-of-things](), [malware](), [model](), [news](), [xcpe]() ### AI overview Google shut down XCPE's command infrastructure and took legal action against domains and servers used to control the botnet. Google attributes the operation with high confidence to Videostrong Technology; more than 1.3 million set-top boxes were tied to XCPE. Criminal affiliates could use the devices for hidden ad views, residential proxies, data theft and further malware, with capabilities including screenshots, keystroke injection and shell access. Google estimates the takedown also cuts off access to at least 10 million compromised devices infected through other routes and malware families. Removal is difficult: the system-privileged backdoor reinstalls from a protected partition after reboot, and later droppers exploit privilege escalation to write there. Google banned Videostrong and future affiliates from certified Android device and software programs, tightened firmware checks and changed manufacturer reviews. The excerpt notes collaboration with law enforcement and security firms. ### Source excerpt Google shut down the servers behind XCPE, a backdoor hidden in the firmware of Android TV set-top boxes. Google's Threat Intelligence Group attributes the operation with high confidence to Videostrong Technology, the company that manufactured many of those boxes. More than 1.3 million devices were enrolled. XCPE malware overview (Source: Google) Access The business model was access. Researchers say the company sold entry to its customers' living rooms to criminal affiliates, who pushed their own ... More -> The post Google disrupts XCPE botnet, bans the company behind it appeared first on Help Net Security. ## Shutting the Door on the XCPE Botnet (Threat Intelligence) DevFeed: [Shutting the Door on the XCPE Botnet (Threat Intelligence)]() Original publisher: [Read original article]() Author: corbet Published: 2026-11-02T14:29:37Z Content type: news Language: en Sources: [LWN.net]() Topics: [Cybercrime](), [IoT botnets](), [residential proxy network]() Tags: [ad-fraud](), [affiliates](), [android](), [backdoor](), [botnet](), [criminal](), [malware](), [modules](), [residential-proxy](), [threat-intelligence](), [xcpe]() ### AI overview Google and industry partners dismantled the XCPE backdoor, which had enrolled more than 1.3 million set-top boxes into a botnet. Google assesses with high confidence that Videostrong Technology Co., an Android OEM and ODM, developed and operated it for financial gain. Videostrong monetized access by selling it to criminal affiliates and loading their modules onto infected devices. Those modules carried out ad fraud, silently enrolled devices in residential proxy networks, and installed additional malware. ### Source excerpt The Google Threat Intelligence blog describes, in great detail, the XCPE botnet, which has just been taken down. Last week, Google and industry partners dismantled the XCPE backdoor which enrolled more than 1.3 million set-top boxes into a botnet. We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co., an Android Original Equipment Manufacturer (OEM) and Original Device Manufacturer (ODM). Videostrong monetized the backdoor by selling access to criminal affiliates and loading those affiliates' malware modules onto infected devices. These secondary modules were conducting ad-fraud; silently enrolling infected devices into residential proxy networks; and loading additional malware onto XCPE-compromised devices.