XCPE botnet: Videostrong Android set-top boxes & IoT devices — manufacturer-embedded backdoor sold access to criminal affiliates, 1.3M+ devices infected (no CVE)
Severity: high · Patch status: no-fix-needed · Since 2026-11-04
Google's Threat Intelligence Group and partners (Japan NPA, Lumen, HUMAN Security, Plume, Synthient, TrendAI) disrupted the XCPE botnet, attributing it with high confidence to Android device maker Videostrong, which since at least 2024 deliberately embedded XCPE backdoor malware in its Android TV set-top boxes and other Android IoT devices (telehealth gear, karaoke machines, digital signage). The vendor monetized the backdoor by selling access to criminal affiliates, whose modules conducted ad fraud, enrolled devices in residential proxy networks, and delivered additional malware; operators could capture screenshots, inject keystrokes, exfiltrate data, and establish reverse shells. Google took legal action to seize C2 domains/servers, cutting off affiliate modules affecting an estimated 10 million additional devices, and banned Videostrong from the certified Android ecosystem. Owners of affected devices should assume compromise.
What to do
- Audit networks for Videostrong-branded Android TV boxes and Android IoT devices and isolate or replace them
- Check firewall/DNS logs for connections to XCPE and affiliate C2 infrastructure
- Treat consumer-grade set-top boxes on corporate/healthcare networks as untrusted; enforce network segmentation
- Block traffic from residential proxy ranges and rely beyond IP reputation/geo-blocking for API abuse defenses
- Monitor for ad-fraud, credential-stuffing, and API abuse originating from consumer ISP addresses
Sources
All live incidents on Threat Watch
