Google barred Videostrong Technology Co. from making certified Android devices after disrupting control of the XCPE botnet, which had enrolled more than 1.3 million set-top boxes.
On Nov. 2, Google said it and industry partners had disrupted the network’s control infrastructure and ended their relationship with Videostrong. The company also barred Videostrong and any future subsidiaries or affiliates from building or selling certified Android devices or supplying software to other certified vendors. Google said it was highly confident Videostrong developed and operated the system to generate revenue. Synthient describes the company as China-based.
TrendAI recorded 1,472,554 infected devices across 206 models in more than 170 countries between June 3 and Oct. 1, 2026. The security firm said intermittent data collection made its tally a lower bound. It counted about 1.33 million devices scheduled for proxy and ad fraud modules.
Google said criminal affiliates paid for access to the devices. Their software used them to generate advertising fraud, route third-party traffic through users’ home internet connections or install more malware. Google said device owners did not know their connections were being used for proxy traffic. The company also reported seeing operators run commands on infected devices, collect account and device data, inject keystrokes and capture screenshots.
Google said Videostrong used obfuscation to evade pre-release checks and load malicious code after a device’s first boot. Most affected products were Android TV boxes, with infected telehealth devices, karaoke machines and digital signage also identified.
Google said its legal action targeted Videostrong’s control domains and servers, as well as domains used to control more than a dozen malware families whose modules were loaded through the backdoor. The company estimated that action against affiliate domains could cut operators off from at least 10 million additional compromised devices reached through channels beyond XCPE.
TrendAI said the takedown disabled remote control of infected boxes but did not remove malicious software from devices already sold. Google said it was improving its firmware review process.
