Google and industry partners dismantled the XCPE botnet last week after the backdoor enrolled more than 1.3 million set-top boxes. The operation matters because the infected devices were not just hacked once; they were used as a distribution layer for ad-fraud, residential proxies, and additional malware modules.
XCPE and 1.3 million boxes
Google says the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co., which it describes as an Android Original Equipment Manufacturer and Original Design Manufacturer. The scale here is not a loose estimate of bad traffic. It is a count of devices pulled into the networked crime operation.
Google worked with Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI to analyze the malware ecosystem and disrupt its operations. The company also took legal action against the domains and servers used to control the botnet and install malware modules, which cut off the machinery that kept the network coordinated.
Videostrong’s affiliate pipeline
Google says Videostrong sold access to criminal affiliates and then loaded their malware modules onto infected devices. Those modules carried out ad-fraud, silently enrolled devices into residential proxy networks, and loaded additional malware onto XCPE-compromised devices.
That setup made the infected boxes more than passive victims. They were turned into infrastructure for other criminals without the users’ knowledge or consent, and Google says the same affiliate-style model exposed at least 10 million additional compromised devices through related C2 domains.
Google’s test gap
Google cut ties with Videostrong and banned it from making devices with preloaded Google apps. It also changed its review process after finding that Videostrong used obfuscation to exploit a gap in Google’s tests and load malicious code after first boot.
That detail is the part device buyers need to watch. The malicious software had been built directly into many different device models and brands over multiple years, so the practical risk sits in supply-chain trust rather than a single bad app or a one-off infection.
The unanswered question is which specific device models and brands were infected, and how long the operation ran on each.
