Why Google's takedown of XCPE left a backdoor on 1.3 million Android devices

Google says a backdoor built into the firmware of more than 1.3 million Android devices, most of them TV set-top boxes, was put there by Videostrong Technology, a device maker that The Hacker News places in Shenzhen, China. Google's Threat Intelligence Group attributes the operation to the company with high confidence and says Videostrong sold access to criminal affiliates. Google and its partners dismantled the backdoor's servers in late October, and reports on the action appeared on 2 November 2026.

The backdoor is known as XCPE. Taking down its servers cut the operators' link to the devices, but the case shows why that is not the end of the problem. In this case, the backdoor stayed on the devices after the servers that control it went dark. For retailers, importers and regulators, the case raises the question of who answers for code that arrives on a device before the buyer opens the box.

What Google says it dismantled

Google and its partners, including Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI, took part in the action. Google says it used legal action against the domains and servers that controlled the botnet and delivered its malware modules. It also acted against the command domains of more than a dozen other malware families that were loaded through the backdoor.

Google assesses that cutting those affiliate command domains will sever access to at least 10 million more compromised devices. Those devices were compromised through other routes, not only through the backdoor.

The device count for the backdoor itself is more than 1.3 million set-top boxes in Google's account. TrendAI counted 1,472,554 infected devices across 206 models between June 3 and October 1 and says the real total is at least that high. The Hacker News cites that count.

The Hacker News also cites TrendAI's country breakdown, which puts the heaviest infections in Malaysia, Brazil, Iraq, Mexico and Taiwan. The United States, Germany, the United Kingdom, Australia and Canada each had roughly 26,000 to 42,000 infected devices in that count.

Why the backdoor outlives the servers

Google says the malware is preloaded in the system partition of the firmware and runs with system-level privileges. Users cannot remove it through normal means. If it is uninstalled from the app area, it reinstalls from the OEM partition when the device reboots. The stub is named x.cpe in some builds and com.oemservice in others.

Taking the servers down cuts the operators' link to the devices, but not the code already written to them. Each reboot restores that code.

Help Net Security reports that since August 2026 operators have used droppers disguised as system packages, plus a privilege-escalation exploit, to write to the system partition directly. The backdoor also changes a global Play Protect setting so that software can be installed without user consent.

Google describes silent app installs, screenshots, keystroke injection, shell commands and the copying of account and device data. It also reports other infected devices, including telehealth devices, karaoke machines and digital signage devices.

Advice on cleanup is not settled. TrendAI, as cited by The Hacker News, says removal needs vendor action, platform protection or replacing the device. Plume recommends a factory reset, and Synthient advises discarding the boxes. Plume does not say whether a factory reset removes x.cpe itself.

Where Videostrong sits in the supply chain

Google describes Videostrong as an Android original equipment and design maker. The Hacker News says it is based in Shenzhen, China, and sells Android TV boxes under its own name and for other brands. Help Net Security says it manufactured many of the infected boxes.

Google says Videostrong sold access to criminal affiliates, who installed their own modules to run hidden ad views, enroll devices in residential proxy networks, steal account details and load further malware. Google's position is that the backdoor was built on purpose, and it does not attribute the activity to a rogue insider or a development mistake.

Google says Videostrong used obfuscation so that the malicious code loaded after first boot, which exploited a gap in Google's OEM compatibility and security testing. The Hacker News reports that Videostrong's website still listed Google Certified Android TV boxes and sticks as of 2 November. Plume found both certified and open-source Android devices affected. Google has not said how many certified devices were involved.

Synthient published a list of 182 device model names seen in the campaign. Its report focuses on MECOOL-branded boxes, which it links to Videostrong. It said it bought a MECOOL KM9PRO Max and found the backdoor preinstalled. Plume found that Videostrong supplies both the firmware and the remote tools used to manage the devices.

What Google expects from retailers and brands

Google's guidance is aimed at the chain between factory and shelf. It says retailers and distributors should require independent security audits from Original Design Manufacturers (ODMs) and quickly delist manufacturers implicated in supply-chain abuse. It says downstream brands, white-label resellers, telecom providers and e-commerce marketplaces share responsibility for closing this route.

Google's own actions follow the same logic. Videostrong, along with any future subsidiaries or affiliates, is banned from building or selling certified Android devices and from supplying software to certified vendors. Google says the company is also barred from preloading Google apps. Google has changed its OEM review process and is improving how it ensures firmware integrity on certified Android TV devices.

For importers and sellers, the case shows that certification did not rule out the backdoor: Plume says the botnet included Google-certified devices. Google says the testing gap was that the malicious code loaded after first boot.

For buyers, Google advises caution with apps that pay for unused bandwidth or for sharing internet access, use of trusted app stores, review of VPN and proxy permissions, and confirmation that Play Protect is active. It advises buying set-top boxes from reputable manufacturers, pointing to its Android TV partner list.

What the UK and EU frameworks cover

The UK's Product Security and Telecommunications Infrastructure Act 2022 lets the Secretary of State set security requirements for relevant connectable products made available to consumers in the UK. The detailed requirements are set in regulations made under that power and are not described here.

The Act sets its maximum penalty at the greater of £10 million or 4% of a person's qualifying worldwide revenue for the most recent complete accounting period (section 38).

The EU Cyber Resilience Act entered into force on 10 December 2024. Reporting obligations apply from 11 September 2026, and main obligations from 11 December 2027. The European Commission says manufacturers must meet cybersecurity requirements across design, development and maintenance, and must handle vulnerabilities over a product's lifecycle. Some products may need a third-party assessment by a notified body before they are sold.