Google and a coalition of industry partners disrupted the XCPE botnet in late October 2026, severing control over more than 1.3 million infected Android devices. The operation, which investigators attributed to the manufacturer Videostrong Technology Co., embedded a persistent backdoor directly into device firmware to facilitate ad fraud and residential proxy services.
Attribution to Videostrong Technology Co.
In a report published on 2 November 2026, Google’s Threat Intelligence Group (GTIG) concluded with high confidence that the backdoor was intentionally developed and deployed for financial gain. The investigation attributed the development, deployment and operation of the backdoor and botnet to Videostrong, an original equipment and design manufacturer based in Shenzhen, China, which monetized the compromised devices by selling access to criminal affiliates. According to Google, the campaign was not the result of a rogue insider or a simple development oversight, but rather a deliberate effort to profit from malware distribution.
The manufacturer reportedly hid the malicious code to bypass certification checks, using obfuscation to load malicious code after a device initially booted up. In response to the findings, Google has banned Videostrong and its future subsidiaries from producing certified Android devices or supplying software for the ecosystem. While Google has severed ties with the manufacturer, the company noted that the open-source nature of Android means the firm could still technically use the operating system on its products. As of November 2, Videostrong’s own website continued to list devices labeled as Google Certified Android TV Box
and Google Certified Android TV Stick.
Mechanics of the Firmware Backdoor
Because the backdoor resided in the firmware, simple application uninstallation was ineffective. The malware utilized native ELF binaries prepackaged within the system, which were unpacked to data directories and spawned as background processes with system-level privileges.
The infrastructure utilized a three-stage architecture that evolved significantly by 2024. To interfere with security inspections, the malware employed several techniques, including disabling Google Play Protect app verification, using anti-analysis utilities to thwart sandbox inspection, and disguising dropper packages as legitimate system applications. The botnet’s capabilities allowed operators to:
- Silently install unauthorized applications.
- Capture live screenshots and inject keystrokes.
- Collect system logs, account details, and device inventories.
- Establish reverse shells for remote command-line access.
- Conduct network reconnaissance.
Monetization Through Residential Proxies
Criminal affiliates used the infected boxes to build large-scale residential proxy networks. By routing traffic through the home internet connections of unsuspecting users, the operators made malicious requests appear to originate from legitimate households. Google identified multiple modules and SDKs used in this ecosystem, including services such as Linkfog, AppSalt, Honeygain, NetNut, and Traffmonetizer. These modules transformed infected devices into residential edge computing and PCDN proxy exit nodes.
One specific service, Linkfog—operated by Beijing Linkfog Technology—branded itself as a Peer-to-Peer Content Delivery Network.
Another module, Moyu, acted as a three-stage backdoor previously linked to the BadBox enterprise. When executing inside specific smart-TV application stores, plugins were triggered to report synthetic ad exposures directly to ad SDKs. Google stated that Videostrong monetized the backdoor by selling access to criminal affiliates and loading those affiliates’ malware modules onto infected devices, turning a single box into a multi-purpose tool for various illicit operations.
Security Firms Advise Replacing Infected Streaming Hardware
While the majority of the 1.3 million infected units were Android TV set-top boxes, the threat also extended to telehealth equipment, karaoke machines, and digital signage.
Security firms including Plume and Synthient have advised that standard resets may not fully remove the infection, with Synthient recommending retiring the hardware. Google noted that long-term mitigation requires vendor action, platform protection or replacement of the device.
The takedown effort involved collaboration between Google, Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI. While the primary XCPE infrastructure is offline, Google warned that the interconnected nature of these criminal networks means that disrupting one node does not necessarily dismantle the entire ecosystem. The company currently estimates that the action could impact access to at least 10 million additional devices currently compromised by related affiliate malware. Ultimately, Google emphasized that securing connected devices requires more than application-level protection, highlighting that firmware integrity, manufacturer accountability, and transparent user consent remain essential parts of the wider security challenge.