Now Hacked
EN
Malware

XCPE backdoor infects over 1.3 million Android devices

First reported · Last reported · 5 related reports

More than 1.3 million devices, including Android set-top boxes, in over 200 countries were infected with the XCPE backdoor and exploited for ad fraud, residential proxy operations, and the installation of additional malware. Google concluded that Chinese manufacturer Videostrong had deliberately preinstalled and operated the malware. Google and its partners disrupted the botnet, and Google ended its business relationship with the manufacturer.

Key facts

Affected organization
Being confirmed
Incident type
Malware
Occurred / detected
Not confirmed
Scale of damage
Over 1.3 million Android devices infected in more than 200 countries
Cause / method
A supply chain compromise believed to involve preinstallation of the XCPE backdoor during manufacturing
Location
Other countries

If your data was exposed

Exposed dataUsername

  1. Change your password, and also change it on any other site where you use the same one. Turn on two-factor authentication if available.

Timeline

  1. Google said that more than 1.3 million set-top boxes were infected with the XCPE backdoor and that it believed Videostrong had deliberately distributed and operated it.
  2. Google and its partners disrupted the XCPE botnet spanning more than 200 countries, with infections also confirmed in telemedicine devices and digital signage.
  3. Google ended its business relationship with Videostrong, and screen manipulation and the external transmission of account information were confirmed on infected devices.

5 related reports

The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organization’s official statements for accurate details.