AI Governance
Data Centers
Drones
Climate
Privacy
2026 Maine Senate
Bob Dylan
Privacy: Featured Story
Coverage from The Record, BleepingComputer, and others
Google Disrupts XCPE Botnet, Bans Videostrong
Google and security partners disrupted the XCPE botnet, which had infected more than 1.3 million Android TV set-top boxes with malware attributed to manufacturer Videostrong Technology. The infected devices were used for residential proxy services, advertising fraud, and distribution of additional malware. Google says the operation also cut access to at least 10 million other compromised devices through related control infrastructure, although the estimate includes devices affected by other malware and the XCPE infection may persist until clean firmware is installed.
If you read one thing
A broad account of the disruption, the alleged role of Videostrong, and the botnet’s uses and limitations of the takedown.
The evidence
Details the malware’s capabilities and explains why the infection may persist until clean firmware is installed.
Best explainer
Adds reporting on proxy services linked to the botnet and the broader reach of the disrupted infrastructure.
The takedown severed access to XCPE control infrastructure, but it did not remove the malware from infected devices. Google also says the action cut off access to other compromised devices, though that broader estimate is not a count of additional XCPE infections.
Google and its partners disrupted XCPE command-and-control infrastructure; Google also ended its relationship with Videostrong and barred it from supplying devices or software to certified Android vendors.
Google estimates that the action cut off access to at least 10 million additional compromised devices through related infrastructure. Those devices were affected by other malware, and the estimate does not establish that they were infected with XCPE.
The backdoor may remain on infected devices and reinstall if removed; BleepingComputer reports that clean firmware or disconnecting the device from the internet is needed to address the infection or prevent further activity.