Google disrupts XCPE botnet, bans the company behind it

Google’s Threat Intelligence Group uncovered XCPE, a firmware-resident backdoor embedded in Android TV set-top boxes made by Videostrong Technology that enrolled roughly 1.3 million devices and enabled affiliates to monetize access (hidden ad views, residential proxy networks, credential/data siphoning, remote control). The backdoor runs with system privileges, reinstalls from a protected partition, disables Play Protect, and since August 2026 has been used with droppers that exploit privilege escalation to write the system partition; Google and multiple partners executed a takedown and manufacturer restrictions to disrupt the botnet and its monetization infrastructure.