Google Dismantles 1.3 Million Device XCPE Botnet, Bans Android TV Maker Over Preinstalled Malware
Google dismantled the XCPE botnet, banning Android TV maker Videostrong for preinstalled malware.
Google, with industry partners, has dismantled the XCPE botnet, which compromised over 1.3 million Android devices, primarily set-top boxes. The operation is linked to Videostrong Technology, an Android device maker accused of deliberately embedding malware for profit. Google has banned the company from producing certified Android devices and is enhancing its device review process.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Videostrong Technology?
Get an email when a new story names Videostrong Technology, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe XCPE botnet demonstrates how hardware supply chain compromise can weaponize consumer devices at scale before they ever reach an end user. Videostrong Technology allegedly embedded malware deliberately into certified Android set-top boxes, meaning no user action or software vulnerability was required — the threat arrived pre-installed from the factory. This undermines the fundamental trust consumers place in certified hardware ecosystems and shows that device certification processes must include deeper firmware and software integrity checks. The scale of 1.3 million compromised devices illustrates how a single bad actor in the supply chain can create outsized harm across a global network.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Cyber asset inventory
You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — mqtt.szbboys[.]com
- malware — x.cpe
- malware — com.oemservice
- malware — com.abc.nexus