Google Dismantles 1.3 Million-Device XCPE Botnet, Bans Videostrong
Updated
Updated · Fox News · Nov 13
Google Dismantles 1.3 Million-Device XCPE Botnet, Bans Videostrong
3 articles · Updated · Fox News · Nov 13
Summary
Google said it disrupted the XCPE malware operation after investigators linked more than 1.3 million compromised devices—mostly Android TV boxes—to China-based manufacturer Videostrong.
Videostrong allegedly hid the XCPE backdoor in device firmware for financial gain, then sold access to criminal affiliates who used infected boxes for proxy services, ad fraud and data theft.
Google said the malware evaded Android certification by concealing itself during testing, loading malicious code after first startup and even disabling Play Protect while surviving reboots and factory resets.
Working with Japan's National Police Agency and cybersecurity firms, Google seized control domains, cut ties with Videostrong and barred the company plus future affiliates from supplying certified Android devices or software.
The takedown does not clean devices already in homes, and researchers have tied the campaign to models including the MECOOL KM9PRO Max as well as some karaoke, signage and telehealth hardware.
How did hidden firmware malware bypass Google's strict security checks to infect over a million certified Android TV devices?
If factory resets cannot erase the XCPE botnet, what hidden dangers still lurk inside your budget streaming box?
1.3 Million Android TV Boxes Compromised: The XCPE Botnet and the Collapse of Supply Chain Trust
Overview
The XCPE botnet incident began when Videostrong Technology Co. deliberately embedded a persistent backdoor into the firmware of Android TV boxes and IoT devices, using code obfuscation to keep the malware hidden during security checks. This allowed the malware to bypass Google’s certification process and infect over a million devices worldwide. When users tried to remove the malware or reset their devices, a hidden service simply reinstalled it, making standard fixes useless. After researchers uncovered clear evidence linking Videostrong to the botnet, Google led a global takedown, seizing control servers and banning Videostrong from the Android ecosystem. As a result, affected users were left without official updates, forcing experts to recommend complete hardware replacement. In response, Google strengthened its security reviews to prevent similar supply chain attacks in the future.