Overview
- Google led a coordinated legal action on Monday that took down XCPE command-and-control domains and severed operator access to at least 10 million compromised devices.
- The company says it has high confidence that Shenzhen-based Videostrong intentionally embedded the XCPE backdoor in firmware and sold access to criminal affiliates for ad fraud, residential proxies, data theft and further malware installs.
- Researchers found more than 1.3 million Android TV set-top boxes enrolled in XCPE and linked the backdoor to multiple device models, brands and some non-TV Android hardware.
- XCPE runs with Android system privileges, reinstalls itself from a protected /oem partition after reboot, disables Play Protect checks, and therefore cannot be reliably removed by users without vendor firmware updates or device replacement.
- Google revoked Videostrong's certification rights, tightened firmware-review and integrity checks, and worked with Japan’s National Police Agency and security firms to publish technical indicators and interim mitigations for networks and organizations.