Google Dismantles XCPE Botnet on 1.3 Million Android TV Boxes

Overview

• Security teams led by Google’s Threat Intelligence Group found the XCPE malware preinstalled in device firmware and identified about 1.3 million infected Android TV boxes across more than 170 countries.
• Google and industry partners removed the botnet’s command‑and‑control servers and barred Shenzhen‑based Videostrong from shipping Android devices, an action Google says cut access to up to 10 million additional compromised devices.
• XCPE lived in a protected firmware partition so it could disable Google Play Protect, execute privileged commands, act as a residential proxy, generate ad‑fraud traffic and allow third parties to buy access to infected boxes.
• Because the malicious code is embedded in firmware, simple app removal does not work and owners must flash clean firmware where possible or disconnect affected devices from the internet to stop reinfection.
• Investigators warn this case highlights wider supply‑chain risks and call on retailers, marketplaces, telcos and regulators to require independent security audits and remove abusive manufacturers to prevent similar schemes.