Google bans Android TV streaming partner Videostrong

According to Google and its industry partners, the botnet XCPE had enrolled more than 1.3 million devices by the time it was dismantled in late October 2026.

In a blog post, the Google Threat Intelligence Group (GTIG) concluded: “with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology.”

Videostrong reportedly monetised the backdoor by selling access to criminal affiliates and loading their malware modules onto infected devices. These secondary modules were: conducting ad fraud; silently enrolling infected devices into residential proxy networks; and loading additional malware onto XCPE-compromised devices.

Google said it also took action to disrupt the command and control (C2) domains that operate the affiliate modules. It reckoned that taking down their C2 domains would sever access to at least 10 million additional compromised devices.

Videostrong Technology had been designated an Android Original Equipment Manufacturer (OEM) and Original Design Manufacturer (ODM). It has now been banned from building and selling certified Android devices.

Google said: “We found this malicious software built directly into many different device models and brands over multiple years, supported by dedicated infrastructure and constantly evolving configurations to evade detection and manage their affiliates. We believe this campaign wasn’t an isolated rogue insider or a development oversight. As a result, Google has cut ties with Videostrong and banned them from making devices with preloaded Google apps.”

Addtionally, Google said it has introduced changes to its existing review process to safeguard against similar activity in the future. It worked closely with Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI to analyse the malware ecosystem and disrupt its operations. 

On an IBC2026 panel, Toby Scales, Chief Information Security Officer, Media, Entertainment, Google, recently stressed the importance of removing silos and leveraging the power of AI to improve cybersecurity and content provenance. Watch more here.