Google disrupts million-device XCPE Android malware botnet, bans TV box maker

The XCPE botnet case represents a deliberate supply chain attack where the device manufacturer, Videostrong Technology Co., intentionally embedded malware into Android TV streaming boxes before they reached consumers. This pre-installation of backdoors at the hardware/firmware level means users had no practical way to detect or prevent infection through normal security hygiene. The botnet was monetized through ad fraud and proxy services, demonstrating how compromised consumer devices can be weaponized for sustained cybercrime at scale. This incident underscores that trust in a product's integrity must be established before purchase, not after deployment, and that hardware certification programs are a critical last line of defense against malicious manufacturers.