Google and security partners disrupt a botnet spanning 1.3 million infected Android streaming devices

Google, Japan's National Police Agency, and security firms including Lumen and TrendAI have disrupted XCPE, a malicious botnet that infected over 1.3 million Android devices across more than 200 countries. Google's Threat Intelligence Group accused Shenzhen-based hardware manufacturer Videostrong Technology of intentionally embedding the backdoor directly into device firmware and monetizing access for criminal affiliates. [1][2]

Running with system-level privileges, the malware enabled attackers to execute shell commands, capture keystrokes, alter security settings, and route illicit web traffic through home networks. The backdoor was also identified on karaoke machines and digital signage. Because XCPE restores itself from a protected firmware partition on reboot, simple app uninstalls cannot clean affected devices, prompting researchers to suggest replacing compromised hardware. [1][2]

Google has banned Videostrong from making certified Android hardware or distributing devices with preloaded Google applications. Beyond the immediate botnet, Google estimates that dismantling the affiliate command infrastructure will cut off access to at least 10 million additional compromised devices. [1][2]