Google disrupts XCPE botnet, bars Videostrong from Android

Google and a coalition of security and law-enforcement partners disrupted the control infrastructure for XCPE, a botnet involving more than 1.3 million Android devices, and barred manufacturer Videostrong from making certified Android devices. Google says the company deliberately built and operated the malware for financial gain; that attribution is Google’s assessment. The operation targeted domains and servers used to control XCPE and distribute malware modules. Google also took legal action against command infrastructure used by more than a dozen other malware families that had been loaded through the backdoor. The company estimates that disrupting those affiliate domains could cut access to at least 10 million additional compromised devices. That figure is a projection, not a count of devices in the XCPE botnet. TrendAI counted 1,472,554 infected devices across 206 models in more than 170 countries between June 3 and October 1, 2026. The security firm said intermittent data collection means its tally is a lower bound. Most affected products were Android TV boxes, though researchers also found the malware on telehealth equipment, karaoke machines and digital signage. Google...