Overview
- Google led a legal and technical disruption of the XCPE command-and-control network and on Monday publicly attributed the firmware backdoor to Videostrong Technology with high confidence.
- Researchers say XCPE was preinstalled in many Android TV set-top boxes as a system-signed backdoor that let operators install modules for residential proxies, ad fraud, data theft, screenshots, keystroke injection, and remote shells.
- TrendAI counted about 1.47 million infected boxes across 206 models and Google estimates the disruption cut access to at least 10 million additional compromised devices routed through affiliates.
- The backdoor is persistent because it lives in protected firmware partitions, disables Play Protect, and reinstalls after reboot, so removal normally requires vendor firmware updates, platform fixes, or device replacement.
- Japan’s National Police Agency and security firms including Lumen, HUMAN Security, Plume, Synthient, and TrendAI assisted the takedown, and Google has banned Videostrong and future affiliates from certified Android device programs and tightened firmware review checks.