Google takes down massive Android TV botnet, but infected devices remain dangerous

Google has taken down a massive Android malware operation that turned over 1.3 million Android TV boxes into weapons for cybercriminals. Google revealed that the operation was performed by Videostrong Technology, a device maker accused of intentionally putting a hidden backdoor on its products and selling access to criminal affiliates. Google’s Threat Intelligence Group said Videostrong developed the backdoor as a business, not letting it slip through accidentally. The malware, dubbed XCPE or x.cpe, was directly embedded in the firmware of Android TV boxes sold under different brands. Criminal partners could use infected devices to generate fake ad views, reroute internet traffic through unsuspecting homes, and install more malware.

System access and firmware persistence

Google is particularly concerned about XCPE because it runs with Android system-level privileges. Connecting to remote command-and-control servers enables attackers to silently install applications, execute shell commands, take screenshots, and collect device information. Google also found that the malware could collect account information, application lists, and system logs. Some operators even used the ability to remotely access the devices to capture keystrokes and establish reverse shells.

Just removing the malware application is not enough. Because the backdoor resides in a protected firmware partition, it restores itself automatically on every device reboot. It can also affect Google Play Protect by changing security settings, making detection and removal much more difficult. Android TV boxes are the most common way the infection spreads, but researchers also saw XCPE on other Android-based devices such as karaoke machines, telehealth equipment, and digital signage systems.

Coordinated takedown and consumer impact

Google worked with Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI to take the operation down. Its complaint targeted command servers operated by Videostrong, as well as the infrastructure behind more than a dozen other families of malware. Google also banned Videostrong and future subsidiaries from making certified Android devices or supplying software to certified manufacturers.

The disruption could spread even further. Disabling the command infrastructure used by criminal affiliates will cut off access to at least 10 million more compromised devices infected through different distribution channels, Google figures.

However, the takedown does not automatically remove XCPE from impacted hardware. According to security researchers, users should identify potentially compromised devices, disconnect them, and consider replacement rather than relying on an ordinary app uninstall. Google also tightened its firmware integrity checks and manufacturer vetting process after finding that Videostrong used obfuscation to load malicious code after a device initially booted up.