Google has dismantled a botnet that compromised more than 1.3 million Android television set-top boxes and barred their alleged malware supplier, Videostrong Technology, from producing certified Android devices.The technology company announced on Monday that coordinated action with law enforcement and cybersecurity partners had disrupted XCPE, a firmware-level backdoor embedded in devices sold under multiple brands. Google Threat Intelligence Group attributed the operation to Videostrong with high confidence, alleging that the manufacturer deliberately installed and operated the malware for financial gain.
Google said it had taken legal action against servers and domains controlling infected devices, alongside infrastructure supporting more than a dozen associated malware families. Disrupting those affiliated networks is expected to cut criminal operators' access to at least 10 million additional compromised devices, although that estimate concerns systems beyond the original XCPE botnet.
The company has terminated its relationship with Videostrong and prohibited the manufacturer, including future subsidiaries and affiliates, from producing certified Android devices or supplying software to other certified manufacturers. Google also announced changes to its device review procedures after identifying weaknesses exploited by the operation.
The allegations mark an unusually direct accusation against a hardware supplier rather than hackers exploiting devices after purchase. Google's investigators said the malicious code had been incorporated into firmware across numerous models over several years, with dedicated infrastructure and changing configurations designed to conceal its activities.
Google said its assessment ruled out an isolated employee acting without authorisation or an accidental development error. Videostrong's response to the allegations was not established in the material released by the investigators, and the attribution remains Google's assessment rather than a judicial finding.
The operation involved Japan's National Police Agency and security organisations Lumen, HUMAN Security, Plume, Synthient and TrendAI. Their work examined the malware's distribution, command infrastructure and commercial relationships before the coordinated disruption.
XCPE gave operators privileged access to devices from their initial installation. Its principal component, identified as x. cpe or com. oemservice in different builds, operated with Android system privileges and could reinstall itself from a protected firmware partition following removal by a user and subsequent reboot.
That persistence distinguishes the infection from ordinary malicious applications. Blocking the botnet's servers does not itself erase the embedded software, meaning devices can remain compromised even when their connection to the original command infrastructure has been interrupted.
Investigators found that the backdoor communicated with remote servers to retrieve configuration information and maintain a channel for instructions. Operators could silently install applications, execute commands, capture screenshots, inject keystrokes and extract information including account details, device inventories and system logs.
Access was also sold to outside operators whose modules exploited consumers' internet connections. Some turned household devices into residential proxies, routing third-party traffic through unsuspecting owners' addresses. Others generated fraudulent advertising activity or installed additional malware, extending the number of businesses and criminal groups benefiting from the infection.
Google identified proxy-related modules including Linkfog, AppSalt and NetNut, alongside advertising-fraud components and additional backdoors. A single compromised device could run several revenue-generating modules simultaneously, investigators found.
Independent analysis by Synthient linked the operation to devices marketed under the MECOOL name. Its investigators identified overlapping infrastructure and company-associated material on servers used to distribute malicious software. Those findings provided supporting evidence for Google’s attribution, although the number of affected models and the proportion still operating after the takedown have not been established. Consumers therefore lack a device-by-device accounting of exposure.
The company said Videostrong used obfuscation to evade compatibility and security checks, arranging for malicious components to load after a device's first startup. Google has consequently strengthened its review process for firmware integrity on certified Android TV equipment.
Researchers traced changes in the malware's architecture, including a separate loader introduced in late 2024. Since August 2026, smaller installation packages disguised as Android system applications have increasingly replaced that general-purpose component, according to Google's technical analysis.
Although television boxes accounted for most infections, investigators also identified compromised Android-based telehealth equipment, karaoke machines and digital signage devices. The geographic distribution was broad, reflecting the range of manufacturers and distributors involved in bringing the hardware to market.
Google's technical findings describe a two-stage communications system that retrieved network settings before establishing a persistent connection to receive instructions. Additional software was hosted on external file-sharing services, developer repositories and operator-controlled servers, allowing modules to be changed without replacing the original firmware.
Topics
Technology