Most botnets get built by breaking into devices. XCPE was different. According to Google, it came preinstalled at the factory.

On November 2, Google Threat Intelligence Group (GTIG) published its account of a coordinated disruption of the XCPE botnet (some outlets write it X.CPE). The botnet lived in the firmware of more than 1.3 million Android set-top boxes and other Android-based Internet of Things devices. GTIG says with high confidence that the device maker, Videostrong Technology Co., an Android original equipment and original design manufacturer (OEM/ODM), intentionally developed and operated the backdoor for financial gain. Videostrong did not respond to The Record's requests for comment.

Google worked on the operation with Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI. The partners took legal action against the botnet's command-and-control (C2) domains and servers, the infrastructure the operators used to send instructions to infected devices.

A backdoor sold as a service

GTIG says Videostrong did not mainly use the backdoor itself. It sold access to criminal "affiliates," who loaded their own modules onto the infected boxes. GTIG says those modules did three things:

  • Ad fraud. Devices quietly loaded and "viewed" ads so someone could collect advertising money for traffic no person ever saw.
  • Residential proxy enrollment. Each box became an exit point for other people's internet traffic. Residential proxies are valuable because the traffic seems to come from ordinary home connections, which makes it harder for websites and fraud filters to block.
  • Additional malware loading. The backdoor served as a foothold for installing other payloads.

The affiliate setup is why the takedown reached well beyond Videostrong's own hardware. GTIG says disrupting the affiliates' C2 domains cuts off access to at least 10 million more compromised devices on top of the 1.3 million boxes tied directly to XCPE. Google told CyberScoop the operation seriously hurt more than a dozen malicious actors. It also cautioned that the wider market for backdoors, ad fraud and proxies is resilient.

How it got past Google's certification

The awkward detail for Google is that these were certified Android devices, the kind allowed to ship with Google's apps preloaded. GTIG says the malware's obfuscation exploited a gap in Android's compatibility testing. The malicious code was loaded only after the device's first boot, so it was not present when certification checks ran.

Google says it has cut ties with Videostrong, banned the company from shipping devices with preloaded Google apps, and changed its OEM review process. GTIG's Charley Snyder would not tell CyberScoop what those changes are.

According to The Record, the malware was built into the firmware before the devices reached customers' homes. It reinstalled itself if a user removed it, and Videostrong updated it in 2024 and again in 2026. That is ongoing development, not a single bad build.

Where the boxes are

The reported reach varies by source. The Record puts the infected set-top boxes in more than 200 countries. TrendAI's figures, cited by CyberScoop, say more than 170 countries, with the largest numbers in Malaysia, Brazil, Iraq, Mexico and Taiwan. TrendAI also counted nearly 44,000 infected devices in the United States between June and October. TrendAI's Robert McArdle spoke to The Record about the research.

Krebs on Security reports that the same XCPE malware also turned up outside living-room TV boxes, in telehealth devices, karaoke machines and digital signage. Those are the sorts of devices that often end up on small-business and clinic networks without anyone in IT knowing about them.

The proxy supply chain

Krebs reports that GTIG's report names several residential-proxy software development kit (SDK) providers. An SDK is a bundle of code that a developer, or in this case a firmware maker, adds to a product. The providers named include AppSalt/Honeygain, which Krebs ties to Oxylabs. Oxylabs relaunched as Source in October 2026 after receiving $130 million in funding from Warburg Pincus, and it did not respond to Krebs's request for comment. Also named is NetNut, owned by Alarum Technologies. Krebs notes the FBI seized NetNut-related domains in July 2026 in connection with a separate botnet called Popa. EarnFM and others appear on the list as well.

Krebs's report does not say any of these providers knew about or took part in the Videostrong backdoor. The point is narrower and more structural. Residential proxy networks need a steady supply of home IP addresses, and in this case some of that supply came from consumer hardware whose owners never agreed to share their connections.

What It Means for Defenders

GTIG says the manufacturer built the backdoor on purpose, and the malware reinstalled itself when users removed it. Google's Charley Snyder told The Record the takedown severed the domains the botnet talked to, "effectively rendering the malware benign," but The Record notes Google did not say whether affected owners will be notified or the malware removed from devices. Treat affected hardware as untrustworthy, not as fixable.

  • Who is affected: owners of Android set-top boxes and other Android IoT devices made by Videostrong. That includes products sold under other brands, because Videostrong works as an ODM. Krebs reports the same malware in telehealth devices, karaoke machines and digital signage, so look past consumer TV boxes.
  • Inventory: find Android-based streaming boxes, signage players and similar appliances on business networks, particularly cheap or unbranded ones that were never formally procured. Write down the manufacturer where you can determine it.
  • Replace, don't clean: since GTIG says the code loads after first boot and the malware reinstalls itself, factory resets and app removal are not reliable fixes. Retire suspect devices and replace them with hardware from vendors you can hold accountable.
  • Segment what you can't remove yet: keep IoT and media devices on their own network segment, away from workstations, servers and anything holding controlled or regulated data. For CMMC environments, an unmanaged Android box on the same network as Controlled Unclassified Information (CUI) systems is a scoping problem as well as a security one.
  • Watch for proxy behavior: a residential proxy node shows up as large amounts of outbound traffic to destinations unrelated to the device's job. If your egress logs show a TV box or signage player talking to far more hosts than its streaming or content service needs, investigate it.
  • Expect your IP to get flagged: a proxy node on your network lends your public IP address to strangers' traffic. That can get your address blocklisted or tied to fraud and abuse you had nothing to do with.
  • Procurement: Google's admission that the backdoor got through Android certification means a "certified" label alone does not prove a device is clean. Factor supply-chain trust into buying decisions for any connected device, especially low-cost hardware.

Google warned that the wider market for backdoors, ad fraud and proxies is resilient. The supply chain that put XCPE on more than 1.3 million boxes did not go away with these domains.

Sources