The XCPE botnet turned more than 1.3 million Android devices into infrastructure for advertising fraud, residential proxy services and additional malware. Disclosed on 2 November 2026, the operation involved a factory-installed firmware backdoor attributed by Google to device manufacturer Videostrong.
Google and an international group of public and private sector partners have now disrupted the botnet’s command and control infrastructure. However, affected Android TV boxes and other appliances may remain compromised because the implant can survive a basic factory reset.
How the XCPE botnet compromise happened
XCPE was not spread through a conventional vulnerability that attackers could exploit remotely. Instead, malicious software was embedded in the firmware of Android TV set-top boxes and some other Android-based devices before they reached users.
Google attributed the development, deployment and operation of the XCPE botnet to Videostrong, stating that the manufacturer used it for financial gain. Videostrong produced devices sold under multiple brands and model names, making the affected population wider than a single recognisable retail range.
MECOOL-branded set-top boxes are among the documented examples linked to Videostrong’s supply chain. Other affected device classes observed during investigations included Android-based telehealth equipment, karaoke machines and digital signage systems.
The operation was active in the wild at significant scale. More than 1.3 million devices were enrolled directly into XCPE, according to Google and independent reporting. Claims in some coverage that 1.3 billion devices were affected are incorrect.
A three-stage malware architecture
Technical reporting describes XCPE as a three-stage system. Its primary backdoor persists on the device’s read-only /oem/ partition, while a loader and execution engine retrieve and run further components. Affiliate modules then provide the functions used to monetise infected devices.
This design gave operators flexibility after a device had been sold and connected to the internet. Modules could enrol its connection into a residential proxy network, generate fraudulent advertising activity, install another backdoor or download additional malware.
Residential proxy access is particularly valuable to criminals because traffic appears to originate from a genuine home or business internet connection. An affiliate could therefore route activity through the victim’s public IP address, making malicious traffic harder for online services to identify and block.
How malicious code evaded certification checks
Google said Videostrong used obfuscation and exploited a gap in Android TV certification testing. The malicious functionality was designed to load after the first boot, rather than presenting itself during the certification process.
This allowed affected equipment to pass checks before activating the backdoor in normal use. Following the investigation, Google changed its device review process to address techniques in which suspicious code is delayed until after initial start-up.
XCPE botnet takedown and investigation timeline
Research into pre-infected MECOOL set-top boxes examined activity dating from early 2020 onwards. Synthient connected those devices to the x.cpe backdoor and traced a broader campaign involving more than 1.3 million compromised systems associated with Videostrong.
On 2 November 2026, Google Threat Intelligence Group publicly identified XCPE and announced coordinated disruption and enforcement action. Participants included Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI.
The coalition dismantled or blocked command and control infrastructure used to manage the XCPE botnet. Google also pursued legal action against domains supporting criminal affiliates that accessed infected devices and deployed their own monetisation modules.
Google assessed that action against this connected infrastructure probably severed affiliate access to at least 10 million additional compromised devices. This figure concerns devices controlled through related affiliate operations and is separate from the approximately 1.3 million devices directly enrolled in XCPE.
Independent reporting between 2 and 5 November 2026 corroborated the scale, technical architecture and uses of the network. McAfee published consumer guidance on 4 November 2026, explaining how Android TV box owners could assess the risk and avoid follow-on scams.
Action against Videostrong
Google banned Videostrong from producing certified Android devices supplied with preloaded Google applications. This measure is intended to stop the manufacturer from using the certified Android ecosystem to distribute further equipment.
The disruption means operators and affiliates should no longer have the same command and control access. It does not mean that the malicious firmware has disappeared from every box. Devices may still contain dormant backdoor components or other modules installed before the takedown.
Why a factory reset may not remove XCPE
The location of the primary backdoor makes remediation difficult. Because it resides on the read-only /oem/ partition, a standard factory reset may erase user data and settings without replacing the compromised firmware.
A reset device could therefore continue to contain XCPE and reconnect if replacement infrastructure becomes available. Reinstalling an ordinary application, changing a password or removing an unfamiliar app would not address a backdoor built into the underlying system image.
Google advises users to replace compromised devices. Synthient similarly recommends permanently disposing of affected equipment and removing it from online marketplaces rather than resetting and reselling it.
There is no public proof of concept to consider because XCPE is not a conventional software flaw. Exploitation was already operational: the manufacturer allegedly installed and managed the backdoor, then sold access to criminal affiliates.
What the XCPE botnet means for UK organisations
Low-cost Android media players are sometimes used in offices, shops and hospitality settings for digital signage, meeting room displays or streaming. Organisations may not record these appliances with the same care as laptops and servers, particularly when staff purchase them directly from online marketplaces.
A compromised box could allow third parties to abuse the organisation’s internet connection for proxy traffic, advertising fraud or further malware delivery. Although disruption has reduced the immediate command and control threat, the persistence mechanism makes continued use difficult to justify.
Actions for organisations with Android TV boxes
Organisations should identify Android-based appliances, establish who manufactured them and check whether they came from Videostrong’s supply chain. Brand names alone may not be sufficient because affected hardware was sold under multiple labels.
-
Disconnect suspected Videostrong or MECOOL equipment from business networks while its provenance is investigated.
-
Replace confirmed affected devices rather than relying on a factory reset. Only use a firmware reimage if a trusted, independently verified image and supported process are available.
-
Review firewall, DNS and proxy logs for published XCPE domains and other observables. Synthient’s public research repository contains indicators for security teams to block and investigate.
-
Place replacement signage, streaming and meeting room appliances on isolated VLANs with access limited to required services.
-
Buy supported devices from traceable suppliers and confirm their certification status, update process and manufacturer before deployment.
The XCPE botnet disruption has removed important criminal infrastructure, but it cannot repair firmware already installed on physical devices. Finding and replacing affected equipment remains the most reliable way to remove the risk.
Originally reported by McAfee.
