Google Disbands XCPE Botnet, Affecting Over 1.3 Million Android Devices
Google has successfully dismantled the XCPE botnet, which impacted more than 1.3 million Android devices, including set-top boxes and other gadgets.
Google has successfully dismantled the XCPE botnet, a significant cyber threat that affected over 1.3 million Android devices, primarily set-top boxes, reported multiple sources 12. This action also severed access for at least 10 million additional compromised devices, marking a substantial blow to the botnet's reach and impact 13.
The XCPE botnet, reportedly developed and deployed by Videostrong, a Chinese technology firm, was utilized for various malicious purposes such as ad fraud, data exfiltration, and loading additional malware onto infected devices 12. Google’s decisive move to dismantle the botnet not only disrupted these activities but also led to the company cutting ties with Videostrong, banning them from manufacturing certified Android devices 23.
In response to this incident, Google made notable changes to its review process for device manufacturers, ensuring a higher level of scrutiny and security for future products 23. Additionally, Google is said to have taken legal action against the botnet’s infrastructure, further solidifying their commitment to protecting Android users from similar threats in the future 1.
The XCPE malware was characterized by a three-stage architecture, allowing it to infect a wide variety of devices beyond just set-top boxes. These included Android TVs, telehealth devices, karaoke machines, and digital signage systems, showcasing the versatility and adaptability of the malware 1.
What we know
- Google dismantled the XCPE botnet 123
- At least 10 million additional compromised devices had access severed 13
- The XCPE botnet was used for ad fraud, data exfiltration, and loading additional malware 12
- Google cut ties with Videostrong and banned them from making certified Android devices 23
- Google changed its review process for device manufacturers 23
- The XCPE botnet affected over 1.3 million Android set-top boxes 12
- Videostrong Technology developed and deployed the XCPE malware 1
- Google took legal action to dismantle the botnet's infrastructure 1
- Videostrong was banned from making devices with preloaded Google apps 1
- The malware had a three-stage architecture 1
- Infected devices included Android TV set-top boxes, telehealth devices, karaoke machines, and digital signage devices 1
Verification report
Likely accurate — probability of truth 79%, weighted across 11 claims from 3 independent outlets.
- confirmed Google dismantled the XCPE botnet. (93%)
- confirmed At least 10 million additional compromised devices had access severed by Google's actions. (85%)
- confirmed The XCPE botnet was used for ad fraud, data exfiltration, and loading additional malware. (85%)
- confirmed Google cut ties with Videostrong and banned them from making certified Android devices. (85%)
- confirmed Google changed its review process for device manufacturers following this incident. (85%)
- likely The XCPE botnet affected over 1.3 million Android set-top boxes. (71%)
- likely Videostrong Technology, a Chinese company, developed and deployed the XCPE malware. (71%)
- likely Google took legal action to dismantle the botnet's infrastructure. (71%)
- likely Videostrong was banned from making devices with preloaded Google apps. (71%)
- likely The malware had a three-stage architecture. (71%)
- likely Infected devices included Android TV set-top boxes, telehealth devices, karaoke machines, and digital signage devices. (71%)
Sources
- SecurityWeek — Google Dismantles XCPE Botnet of 1.3 Million Android Devices
https://www.securityweek.com/google-dismantles-xcpe-botnet-of-1-3-million-android-devices/ - The Verge — One of Google’s Android partners turned 1.3 million set-top boxes into a botnet
https://www.theverge.com/tech/1024807/google-botnet-android-tv-shut-down - 9to5Google — Google shuts down a sneaky malware backdoor on millions of Android TV and Google TV boxes
https://9to5google.com/2026/11/02/google-android-tv-box-backdoor-shut-down/