Technology
Google and partners dismantle botnet linked to millions of backdoored Android devices
Google says it worked with industry partners to dismantle XCPE, a botnet that enrolled more than 1.3 million Android TV boxes and secretly resold users’ internet connections for proxy access and advertising fraud. The malware was also found in telehealth devices, karaoke machines, and digital signage. Google says legal action cut off the operator’s control infrastructure and addressed a device-boot weakness. Researchers estimate the operation may disconnect access to more than 10 million additional compromised systems, but say the 1.3 million figure is conservative.
Editorial summary · Publisher article
What matters
- The malware enabled residential proxy services and could support account takeovers, scraping, and advertising fraud.
- Google attributed the backdoor to TV-box manufacturer Videostrong and severed its ties to the company.
- Synthient found similar malware in MECOOL devices and linked the ecosystem to multiple proxy providers.
- Researchers described the likely affected-device count as substantially larger than the confirmed 1.3 million.
Context & caveats
- The manufacturer attribution and broader device estimates are reported conclusions from Google and researchers, not independently established findings in the packet.
Why this made the edition
The packet provides substantial, specific reporting on a large botnet takedown, affected device categories, abuse mechanisms, industry actions, and remaining uncertainty about its scale.
Source material