Overview
- Google and partner security firms, with support from Japanese police, disabled the botnet control servers on Tuesday, removing direct criminal access to at least 1.3 million Android devices and disrupting reach to roughly ten million more.
- Investigators say the backdoor—identified in reporting as the XCPE component—was intentionally embedded in firmware by Videostrong Technology and gave attackers system‑level control to install apps, run commands, capture screens, and exfiltrate account and device data.
- Researchers found the malicious agent posed as a remote‑management client and received updates from a dedicated GitHub page, which helped operators install additional malware modules used for residential proxying and large‑scale ad fraud.
- In response Google cut business ties with Videostrong, barred the firm from shipping certified Android devices with preinstalled Google apps, and said it will tighten firmware review and vendor vetting for Android‑TV devices.
- The case highlights a wider supply‑chain risk because firmware suppliers can push compromised code across many brands and products, which leaves owners uncertain which models are affected and makes device remediation or replacement the main practical fix for users.