# XCPE botnet Published articles for XCPE botnet. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## 1.3 million Google-certified Android TV boxes found to have malware DevFeed: [1.3 million Google-certified Android TV boxes found to have malware]() Original publisher: [Read original article]() Author: Jean-Luc Aufranc (CNXSoft) Published: 2026-11-04T03:52:05Z Content type: news Language: en Sources: [CNX Software - Embedded Systems News]() Topics: [Malware](), [IoT botnets](), [Android Security](), [Android](), [Embedded Systems]() Tags: [ad-fraud](), [affiliates](), [amlogic](), [android](), [android-tv](), [backdoor](), [botnet](), [c2](), [disrupt](), [google](), [hack](), [hardware](), [malware](), [mecool](), [realtek-rtd](), [residential-proxy](), [security](), [tv-box](), [videostrong](), [xcpe](), [xcpe-botnet]() ### AI overview Google reported that 1.3 million Android TV boxes were infected with the XCPE backdoor and used in a botnet for financial gain. It assesses with high confidence that Videostrong Technology developed and operated the backdoor, which could reinstall after reboot. A loader enabled affiliate modules for residential proxy networks, ad fraud, and other monetization. Google disrupted the command-and-control domains and cut ties with Videostrong, ending its ability to preload Google apps or obtain certification. The malware evaded security testing by using obfuscation and loading malicious code after first boot; Google says it has changed its review process. Because the backdoor remains in device firmware, the article says removal requires flashing custom firmware, if available. It identifies Videostrong and MECOOL devices as likely affected, while noting that impact varies by country. ### Source excerpt You might assume that a Google-certified Android TV box will both work better and guarantee no malware. However, you'd be wrong, at least for the latter. Google has just published a new Threat Intelligence report entitled "Shutting the Door on the XCPE Botnet", where they found that 1.3 million TV boxes were infected by the XCPE backdoor, enrolling them into a botnet used for financial gains. Google assesses with high confidence that the malware was intentionally developed, deployed, and operated by Videostrong Technology, a TV box manufacturer, which we frequently covered in the past when Android TV boxes were still somewhat a novelty and at times usable as an alternative to SBCs running Linux. Videostrong apparently monetized the backdoor by allowing affiliates to load malware modules onto infected devices to run ad-fraud schemes, enroll the TV boxes in residential proxy networks, and so on. Google took legal action to disrupt [...] The post 1.3 million Google-certified Android TV boxes found to have malware appeared first on CNX Software - Embedded Systems News. ## Google Dismantles XCPE Botnet of 1.3 Million Android Devices DevFeed: [Google Dismantles XCPE Botnet of 1.3 Million Android Devices]() Original publisher: [Read original article]() Author: Ionut Arghire Published: 2026-11-03T09:22:09Z Content type: news Language: en Sources: [SecurityWeek]() Topics: [IoT botnets](), [Android Security](), [Google]() Tags: [ad-fraud](), [affiliates](), [android](), [android-tv](), [backdoor](), [backdoors](), [botnet](), [china](), [command-and-control](), [data-exfiltration](), [devices](), [digital-signage](), [disrupted](), [featured](), [google](), [iot](), [japan](), [karaoke](), [malware-threats](), [odm](), [oem](), [takedown](), [xcpe](), [xcpe-botnet]() ### AI overview Google dismantled XCPE, a botnet of more than 1.3 million Android devices that it says Videostrong Technology deliberately built into multiple device models and operated for financial gain. Its three-stage malware persisted on the /oem/ partition, then loaded modules used for ad fraud, data exfiltration, residential proxy services, and additional malware. Videostrong sold affiliates access to infected devices. Google says obfuscation let the company load malicious code after first boot, exploiting a gap in its compatibility and security tests; Google has banned Videostrong from making devices with preloaded Google apps. Legal action targeted XCPE's domains and servers and command-and-control domains for other modules, likely severing access to at least 10 million additional devices. Google says the disruption affected over a dozen malicious actors, but the interconnected illicit market can adapt by switching loaders or monetization SDKs. Infected devices included Android TV boxes and some telehealth, karaoke, and digital signage devices. ### Source excerpt The botnet was created and operated for financial gain by Android OEM/ODM Videostrong Technology. The post Google Dismantles XCPE Botnet of 1.3 Million Android Devices appeared first on SecurityWeek. ## Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies DevFeed: [Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies]() Original publisher: [Read original article]() Author: BrianKrebs Published: 2026-11-03T02:24:31Z Content type: news Language: en Sources: [Krebs on Security]() Topics: [IoT botnets](), [Internet of things](), [pay-per-install](), [malware protection](), [account takeover]() Tags: [a-little-sunshine](), [advertising](), [alarum-technologies](), [android-tv](), [appsalt](), [ben-brundage](), [bmw-ipweb](), [botnet](), [earnfm](), [gaganode](), [google](), [google-threat-intelligence-group](), [honeygain](), [internet-of-things-iot](), [jaguar](), [kimwolf](), [linkfog](), [mecool](), [motion-picture-association](), [ne-er-do-well-news](), [netnut](), [skyworth-technology](), [source](), [superbox](), [synthient](), [takedown](), [traffmonetizer](), [web-fraud-2-0](), [xcpe-botnet]() ### AI overview Google and industry partners dismantled the XCPE botnet, which enrolled more than 1.3 million Android TV boxes and may have connected to over 10 million additional compromised devices. Google says Videostrong Technology Co. used malware to sell infected devices' internet connections through residential proxy services, enable advertising fraud, and distribute affiliates' malware. The same malware was found in other Android IoT products, including telehealth devices, karaoke machines, and digital signage. Google took legal action against the domains and servers used to control XCPE and says it fixed a weakness that let malware load on first boot despite device security requirements. The report names several proxy providers linked to infected devices and cautions that affiliates also distributed their modules through channels beyond XCPE, so the 1.3 million figure may understate the wider impact. ### Source excerpt Google said today it worked with industry partners to dismantle a botnet made up of more than 1.3 million Android TV set-top boxes that ship with malicious software which secretly rents the user's Internet connection out to strangers and conducts advertising fraud. Experts involved in the takedown say the action is likely to sever the botnet's access to more than 10 million additional compromised systems, including other Internet of Things (IoT) products such as Android-based healthcare devices and karaoke machines.