Google Threat Intelligence Group said on 3 November 2026 that last week Google and industry partners dismantled the XCPE backdoor, which enrolled more than 1.3 million set-top boxes into a botnet, and that it assesses with high confidence the backdoor and botnet were intentionally developed, deployed and operated for financial gain by Videostrong Technology Co., an Android device manufacturer.

Google says the malware was built directly into many device models and brands over multiple years, runs with Android system privileges, reinstalls itself from the /oem/ partition on reboot if a user removes it, and was used to sell access to criminal affiliates whose modules carried out ad fraud, silently enrolled devices into residential proxy networks and loaded further malware; it also says it observed Videostrong operators capturing live screenshots, injecting keystrokes, exfiltrating account information, device information and system logs, and establishing reverse shells on devices.

Google says it took legal action to take down the domains and servers Videostrong used and the command-and-control domains of more than a dozen malware families loaded through the backdoor, which it assesses will sever access to at least 10 million additional compromised devices; banned Videostrong and any future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors; and changed its review process after Videostrong used obfuscation to load malicious code after a device's first boot.

Google says it worked with Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI. (source: Google Threat Intelligence Group)

According to BleepingComputer, the takedown does not remove the malware from infected devices, so users would need to install clean firmware or disconnect the device from the internet. (source: BleepingComputer)