botnet Android security malware supply chain cybercrime

1.3 Million Android TV Boxes Were Secretly Backdoored and Sold to You

4 November 2026

Japanese police and a coalition of private-sector firms including Google, Lumen, and Human Security have disrupted XCPE, a backdoor deliberately embedded by Chinese manufacturer Videostrong Technology into Android TV boxes and projectors, which infected over 1.3 million devices across 200+ countries. The backdoor allowed criminals to use victims' internet connections as proxy networks and install additional malware, with operators selling access to criminal affiliates for financial gain. Taking down the botnet's command-and-control infrastructure is expected to sever access to at least 10 million further compromised devices, and Google has since banned Videostrong from producing devices with preloaded Google apps.

A joint operation between Japan's National Police Agency and a roster of private security firms has taken down XCPE, a backdoor quietly baked into Android TV boxes and projectors that ended up in homes across more than 200 countries. The infected device count stands at over 1.3 million, though the downstream damage is considerably larger.

Google, Lumen, Human Security, Plume, Synthient, and TrendAI all had a hand in the disruption. Google's Threat Intelligence Group was characteristically direct in its assessment: Videostrong Technology, a Shenzhen-based hardware manufacturer, deliberately built the backdoor into device firmware and then sold access to criminal affiliates. This wasn't a supply chain compromise or some opportunistic hack. It was the product, by design.

The mechanics are depressingly straightforward. Buyers picked up what looked like a cheap Android TV box, plugged it in, and unwittingly handed criminals a foothold inside their home network. The preinstalled management agent was dressed up as a legitimate remote-management client, pulling updates from GitHub and phoning home to an MQTT server that gave operators full control: installing apps, wiping them, tweaking settings, pushing malware modules from affiliate partners. All running quietly in the background while someone watched football.

TrendAI tracked more than 3.8 million distinct IP addresses connected to the operation between June and October last year. That figure covers both home and mobile connections, suggesting the botnet's reach extended well beyond the originally infected hardware.

Beyond the boxes themselves, the coalition also went after the command-and-control infrastructure used by XCPE's criminal affiliates. Google reckons that taking down those C2 domains cuts off access to at least 10 million further compromised devices, since the affiliates had their own distribution networks operating independently of XCPE.

Google has since booted Videostrong from its OEM programme entirely. The company is now banned from shipping devices with preloaded Google apps. Whether that stings a manufacturer apparently comfortable selling backdoored hardware to unsuspecting consumers is another question.

Videostrong has not responded to press inquiries. Shocking.

READ NEXT

Google Killed a Botnet Living on 1.3 Million Certified Android TV Boxes North Korea's Fake Recruiters Have Infected 30,000 Devices and Counting Russian Hacker Extradited Over Excel Macro Campaign That Hit 80,000 Freelance Platform Users