Google Dismantles XCPE Botnet Preinstalled on 1.3 Million Android Set-Top Boxes

Google and its partners disrupted XCPE, a backdoor that had enrolled more than 1.3 million Android set-top boxes into a botnet. Google Threat Intelligence Group, which published its findings on 2 November 2026, attributes the malware with high confidence to Videostrong Technology, an Android device manufacturer. The backdoor was embedded in device firmware, ran with system-level privileges, and reinstalled itself when users tried to remove it. Affiliates reportedly used the compromised devices for residential proxy services, ad fraud, and additional malware. As a result, Google cut ties with Videostrong, barred it from producing certified Android devices, and took down the command infrastructure, cutting off an estimated 10 million more compromised devices.