Google has led a major cybersecurity operation to dismantle a botnet controlling more than 1.3 million Android devices, primarily TV set-top boxes, in late October 2026. The botnet relied on a preinstalled firmware backdoor known as x.cpe, which Google alleges was intentionally embedded by Chinese device manufacturer Videostrong. Cybercriminals exploited infected devices to conduct advertising fraud, steal sensitive information and route malicious internet traffic through residential connections. Working alongside Japan’s National Police Agency and cybersecurity firms, Google seized control of malicious infrastructure and disrupted command-and-control (C2) servers associated with multiple malware families.
ANDROID BACKDOOR ENABLED REMOTE ACCESS AND DATA THEFT
The x.cpe backdoor operated with system-level privileges, allowing attackers to disable Google Play Protect, silently install malicious applications, capture screenshots, record keystrokes and execute remote commands. Researchers identified infections across hundreds of device models, including Android TV boxes, digital signage systems and telehealth equipment. TrendAI documented approximately 1.47 million infected devices across 206 models, with significant concentrations in Malaysia, Brazil, Iraq, Mexico and Taiwan. Criminal operators primarily used compromised devices as residential proxies, disguising malicious traffic as legitimate household internet activity while generating fraudulent advertising revenue.
GOOGLE BLOCKS DEVICE MANUFACTURER AS SECURITY RISKS REMAIN
Google permanently banned Videostrong and its future affiliates from producing or supplying software for certified Android devices after investigators linked the manufacturer to the malicious operation. Although the takedown disrupted the botnet’s infrastructure and potentially affected malware operations involving millions of additional devices, the embedded backdoor remains present on compromised hardware. Cybersecurity researchers warn that factory resets cannot reliably eliminate firmware-level infections because the malicious software can reinstall itself after restarting. Consumers and organizations should identify potentially affected devices, disconnect compromised equipment, replace unsafe hardware and isolate untrusted smart devices from sensitive networks.