Google and partners dismantle botnet of over 1.3 million Android devices

According to Google Threat Intelligence Group, the XCPE backdoor and the botnet built upon it were most likely created and operated for financial gain by Chinese manufacturer Videostrong Technology, based in Shenzhen. Google claims the company embedded a hidden access channel into the firmware during manufacturing and sold access to the hardware to third-party operators. The infected devices were utilized for advertising fraud, as residential proxy network nodes, and to install additional malicious software.

Besides Google, the operation involved the National Police Agency of Japan as well as Lumen, Human Security, Plume, Synthient, and TrendAI. As Habr reports, citing The Register, the network spanned devices across more than 200 countries. Between June 3 and October 1, 2026, TrendAI identified over 3.8 million unique IP addresses, both residential and mobile, linked to the operation. The coalition also took down command domains associated with the botnet's partners; Google believes this will cut off the operators' access to at least another 10 million compromised devices.

Google severed ties with Videostrong, revoked its license to produce Android TV devices with pre-installed Google services, and banned the company and its affiliates from manufacturing certified Android devices and providing software for them.