Google leads takedown of massive XCPE malware botnet made of more than 1.3 million Android TV streaming boxes and claims the items were intentionally set up for criminal access

Date:
Tue, 03 Nov 2026 10:47:02 +0000

Description:
A Chinese company allegedly intentionally infected its devices with malware and later sold access to a botnet to criminals.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Google leads efforts to dismantle 1.3 million device residential proxy botnet built through malware preinstalled on Android hardware Researchers say manufacturer Videostrong intentionally shipped malware and sold botnet access to cybercriminals Google seized infrastructure, blocked the company from Android certification, and strengthened device security checks Google has revealed its role in taking down a massive residential proxy network and the malware that built it - with the unusual twist that the developer was a seemingly legitimate business with multiple products and countless trusting customers.

In a blog post , the company said that together with its partners, it dismantled a backdoor called XCPE. This malware was apparently used for ad fraud, served as a dropper for additional malware, and used for assimilating devices into an illegal residential proxy network. In total, more than 1.3 million set-top boxes alone were part of the network, the company said.
Latest Videos From TechRadar Watch full video here: No supply chain attack Malicious residential proxy networks are nothing new - they emerge and get dismantled on a regular basis. But this one was unique, as it came preloaded on Android devices built and sold by a certified Android Original Equipment Manufacturer (OEM) and Original Design Manufacturer (ODM). In other words, people were thinking they were buying a legitimate product from a legitimate, Google-vetted company, but were instead getting malware-laden hardware that abused their trust and sold their bandwidth to cybercriminals.

In this case, not only did the company know what it was doing, but it was actively developing the malware and even worked on hiding it from Google and everyone else. You may like Experts warn cheap Android phones are being shipped with malware built in, so be on your guard Samsung and LG will remove 'botnet' apps from their smart TV app stores, but how did it get so bad? D-Link, Ubiquiti devices hijacked by hackers to plunder stolen bandwidth

A device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust, and represents a serious risk to those users, Google said, not hiding its disappointment with the manufacturer.

Videostrong ended up selling two things: On the surface, it was selling Android-powered smartphones and similar devices that contained malware that built a botnet. Under the table, it was selling access to that botnet to cybercriminals. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners
or sponsors By submitting your information you agree to the Terms &
Conditions and Privacy Policy and are aged 16 or over.

Google was joined by a number of other companies and agencies in this operation, including Japans National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI.

Threat actors are always in need of residential proxy botnets. They can use them to launch powerful Distributed Denial of Service (DDoS) attacks, hide their addresses as they operate, conduct large-scale credential stuffing campaigns, bypass geographical restrictions, scrape websites at scale, and more. We dont know how much Videostrong made from selling access to the botnet, or who used it. Taking down the C2 domains To disrupt both the
malware and the network, Google took down the domains and servers the company used to control the botnet and install malware modules, took down C2 domains that were used by over a dozen malware families loaded as modules via the
XCPE backdoor, and banned Videostrong and all future subsidiaries and affiliates from building and selling Android devices in the future, or supplying software to other certified vendors. What to read next Android car systems abused by hackers to launch new malware that pulls devices into a hidden proxy network Just when we thought targeted ads couldn't get any
worse, these were found serving malware 'What appears to be a simple scam message is often the visible end of a much larger transnational cybercriminal operation': Microsoft leads global takedown of phishing network which sent over a billion messages

Google also said it had improved its firmware integrity checks for certified Android TV devices to prevent similar incidents involving other
manufacturers.

Google requires OEMs go through a comprehensive suite of compatibility and security tests to ensure a consistent and safe user experience across the Android ecosystem, it stressed. However, Videostrong employed obfuscation techniques to exploit a gap in our tests and load malicious code after the device's first boot. As a result, Google has implemented changes to its existing review process to better safeguard against similar activity in the future.

This is not the first time an electronic device came with malware off the shelf. Last month, security researchers Bitdefender found Android phones from multiple manufacturers , including Doogee and Cubot (both Chinese firms)
being sold with preloaded malware. However, in those cases, the supply chain was compromised and the malware was included without the OEMs knowledge, or consent. The best antivirus for all budgets Our top picks, based on
real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/google-leads-takedown-of-massive-xcpe-m alware-botnet-made-of-more-than-1-3-million-android-tv-streaming-boxes-and-cla ims-the-items-were-intentionally-set-up-for-criminal-access


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)