Google blocked the XCPE botnet / More than 1.3 million Videostrong TV Boxes were infected at the factory

Google has blocked the infrastructure of the XCPE botnet, which controlled more than 1.3 million Android devices, including TV Boxes manufactured by Videostrong Technology. According to the Google Threat Intelligence Group, the malware was installed before the devices reached buyers and could be activated after the first startup.

Unlike ordinary infections, users did not have to download suspicious applications or visit dangerous websites. The malicious code was integrated into the devices’ software, and Google says the manufacturer may have built and operated the system, later selling access to operators involved in illegal activities.

XCPE used owners’ internet connections to redirect traffic, generate fake advertising views, and install other programs. The malware could execute commands remotely, take screenshots, simulate keystrokes, collect information about accounts and applications, and disable Google Play Protect. Starting in 2024, the mechanism was modified to evade detection, and removing the application was not enough because it reinstalled itself after a reboot.

Google, together with security firms and authorities, blocked the command-and-control servers and ended its cooperation with Videostrong. The measures could also affect access to at least 10 million devices compromised through associated networks. The company recommends that owners disconnect suspicious devices from the internet and request secure software or a device replacement from the manufacturer.