XCPE backdoor infects over 1.3 million Android devices
More than 1.3 million devices, including Android set-top boxes, across over 200 countries were infected with the XCPE backdoor and exploited for advertising fraud, residential proxy operations and the installation of additional malware. Google concluded that Chinese manufacturer Videostrong had deliberately preinstalled and operated the malware. Google and its partners disrupted the botnet, and Google ended its business relationship with the manufacturer.
Key facts
- Affected organisation
- Being confirmed
- Incident type
- Malware
- Occurred / detected
- Not confirmed
- Scale of damage
- Over 1.3 million Android devices infected in more than 200 countries
- Cause / method
- A supply chain compromise believed to involve preinstallation of the XCPE backdoor during manufacturing
- Location
- Other countries
If your data was exposed
Exposed dataUsername
- Change your password, and also change it on any other site where you use the same one. Turn on two-factor authentication if available.
Timeline
- Google said that more than 1.3 million set-top boxes were infected with the XCPE backdoor and that it believed Videostrong had deliberately distributed and operated it.
- Google and its partners disrupted the XCPE botnet spanning more than 200 countries, with infections also confirmed in telemedicine devices and digital signage.
- Google ended its business relationship with Videostrong, and screen manipulation and the external transmission of account information were confirmed on infected devices.
5 related reports
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.