The operation, announced on November 2, 2026, targeted the XCPE botnet, which allowed attackers to remotely control infected devices and use them for various criminal activities.

How the XCPE Botnet Worked

The x.cpe backdoor operated as a system application with elevated privileges, allowing attackers to remotely control infected devices.

Through the malware, operators could:

• Install applications without users’ knowledge.
• Disable Google Play Protect.
• Execute remote commands and capture screenshots.
• Collect account details, device information and system logs.
• Turn infected devices into residential proxies.
• Generate fraudulent advertising traffic.

Although most affected devices were Android TV boxes, the backdoor was also identified in telehealth equipment, karaoke machines and digital signage devices.

Google Takes Action Against Videostrong

Google used legal action to shut down domains and servers responsible for controlling the XCPE botnet and distributing additional malware modules.

The operation involved Japan’s National Police Agency and cybersecurity organizations including Lumen, HUMAN Security, Plume, Synthient and TrendAI.

Google also banned Videostrong and its future subsidiaries or affiliates from manufacturing certified Android devices or supplying software to other certified manufacturers.

The disruption is expected to cut off criminal access to at least 10 million additional compromised devices associated with other malware families.

Infected Devices Remain at Risk

The backdoor is embedded in device firmware and can reinstall itself after a restart. Consequently, simply deleting the malicious application may not permanently remove the infection.

Synthient has published a list of 182 device model names identified during its investigation, although a model appearing on the list does not automatically confirm infection.

Organizations are advised to identify potentially affected devices, block associated malicious infrastructure and isolate unmanaged smart devices from sensitive corporate networks.

Google has also modified its Android device certification review process to strengthen firmware security checks and prevent similar techniques from bypassing testing.

The post Google Disrupts Android Botnet Infecting 1.3 Million Devices appeared first on First Hackers News.