Google dismantles XCPE botnet infecting 1.3 million Android set-top boxes

Google Threat Intelligence has published a detailed account of the XCPE botnet takedown, which enrolled over 1.3 million set-top boxes into a malicious network. The backdoor was intentionally developed by Videostrong Technology Co., an Android OEM and ODM, which sold access to criminal affiliates who deployed secondary malware modules for ad fraud, residential proxy abuse, and additional payload delivery. Google has severed its business relationship with Videostrong and banned the company from shipping devices with preloaded Google applications.

The operation represents a rare public attribution of supply-chain compromise to a specific hardware manufacturer rather than treating it as an isolated security lapse or rogue employee action. The scale of infection and the commercial structure—selling backdoor access to multiple criminal affiliates—illustrates how low-cost IoT and streaming hardware can serve as persistent infrastructure for downstream cybercrime.

Botnet architecture and supply-chain compromise

• Pre-installed backdoor: The XCPE backdoor was embedded at the manufacturing stage by Videostrong, an Android OEM/ODM, affecting set-top boxes before they reached consumers.
• Affiliate monetization model: Videostrong sold access to the compromised devices, enabling criminal affiliates to load their own malware modules onto the 1.3 million infected units.
• Secondary payload capabilities: Affiliate-deployed modules conducted ad fraud, silently enrolled devices into residential proxy networks, and facilitated additional malware installation.
• Attribution confidence: Google assessed with high confidence that the backdoor was intentionally developed and operated for financial gain, not a development oversight or rogue insider.
• Vendor consequences: Google terminated its partnership with Videostrong and prohibited the company from distributing devices with preloaded Google apps.

Why it matters

This case exposes how Android's open licensing model for OEMs can be exploited when hardware manufacturers themselves become the threat actor, undermining trust in low-cost streaming and IoT devices that run Linux-based Android systems. For Linux distribution maintainers and security researchers, the XCPE operation highlights the difficulty of detecting supply-chain compromises in devices that receive irregular or no firmware updates, and the need for stronger hardware attestation and update verification in the open-source Android ecosystem.