Google Dismantles XCPE Botnet on 1.3 Million Android TV Boxes, Accuses OEM Videostrong of Intentional Malware Installation
Google led the takedown of the XCPE residential proxy botnet comprising 1.3 million Android TV boxes, revealing that manufacturer Videostrong intentionally shipped malware to sell access to cybercriminals.
On November 3, 2026, US technology company Google disclosed that it had worked with partners to dismantle a massive residential proxy network known as XCPE. The network consisted of more than 1.3 million Android TV streaming boxes used for ad fraud, dropping additional malware, and providing illegal residential IP proxy access to cybercriminals.
Unlike typical supply chain attacks, Google stated that this threat originated from intentional actions by the device manufacturer. The company involved, Videostrong, is a Google-certified Original Equipment Manufacturer (OEM) and Original Design Manufacturer (ODM). Researchers noted that the company not only knew about the malware but actively developed it, using obfuscation techniques to bypass Google's security tests and load malicious code after the device's first boot. While selling ostensibly legitimate Android smartphones and similar devices, Videostrong secretly built a botnet via the pre-installed XCPE backdoor and sold access to this infrastructure on the underground market.
In this operation, Google collaborated with agencies and companies including Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI. Google seized the domains and servers used to control the botnet and install malware modules, disrupting command-and-control infrastructure for over a dozen malware families loaded via the XCPE backdoor. Additionally, Google has banned Videostrong and all future subsidiaries or affiliates from building and selling Android devices or supplying software to other certified vendors.
To address the vulnerabilities exposed by this incident, Google announced improvements to its firmware integrity checks for certified Android TV devices to prevent similar issues with other manufacturers. Google emphasized that while OEMs are required to pass comprehensive compatibility and security tests, Videostrong exploited gaps in these tests to inject malicious code post-manufacturing. This case highlights a critical trust crisis in the hardware supply chain, demonstrating that certified vendors can directly construct malicious infrastructure.