Overview
- Google and industry partners took down the XCPE command-and-control servers on Monday, November 2, 2026, cutting active remote control of more than 1.3 million Android TV set-top boxes and disrupting access used by at least 10 million additional compromised devices.
- Google says it has high confidence that Shenzhen-based Videostrong intentionally embedded the x.cpe backdoor in device firmware and has banned the company and its affiliates from making or supplying certified Android devices.
- The backdoor runs as a system app with Android system privileges, can disable Google Play Protect, and automatically reinstalls from a protected /oem partition, which means owners need clean vendor firmware or device replacement to fully remove it.
- Researchers found Videostrong monetized access by selling control to criminal affiliates who ran modules for residential proxy services, hidden ad fraud, data theft, and further malware deployment on infected boxes.
- Google tightened certification checks and took legal action on control domains, and security vendors recommend isolating or removing suspect boxes, blocking known C2 domains, and treating unmanaged consumer devices as part of an organization’s attack surface because the backdoor market can quickly pivot to new tools.