Can owners remove the XCPE backdoor themselves?

No. It reinstalls from the firmware partition on reboot.

Does the takedown clean infected boxes?

No. The backdoor survives on the boxes after the takedown.

How many devices were enrolled?

More than 1.3 million Android devices were enrolled.

What should organizations do first?

Disconnect affected boxes and block the control domains.

ResourcesBlog

XCPE Firmware Backdoor: 1.3 Million Devices Enrolled Before Takedown

Google and partners dismantled a firmware backdoor on more than 1.3 million Android devices. The backdoor survives on the boxes, so disconnect and discard, do not trust a reset.

Leonard EserePublished 2026-11-03Reading time 5 min

Filed underXCPE Videostrong firmware backdoor botnet supply chain device inventory

XCPE Firmware Backdoor: 1.3 Million Devices Enrolled Before Takedown

Summary

Google and partners dismantled the XCPE firmware backdoor in late October 2026.
More than 1.3 million Android devices were enrolled, mostly television set top boxes.
The backdoor survives on the boxes, so owners cannot remove it alone.
Disconnect affected boxes, block the control domains, and segment smart devices.

What Google dismantled

Google and partners dismantled a large firmware backdoor in late October 2026. The backdoor is called XCPE. It ran on more than 1.3 million Android devices. Most of the devices were television set top boxes. Google assesses with high confidence that Videostrong Technology Co built the backdoor on purpose. The firm sold access to criminal affiliates for financial gain. Partners in the action included the Japan National Police Agency and Lumen. HUMAN Security, Plume, Synthient, and TrendAI also took part.

How the backdoor worked

The backdoor shipped preloaded in device firmware as a system app. In some builds it used the name com.oemservice. It ran at android.uid.system privilege. That level gives broad control over the device. It reinstalls from the /oem/ partition on reboot. Owners cannot remove it on their own. It disables Google Play Protect app verification. It can silently install apps and run shell commands. It can capture screens and inject keystrokes. It can exfiltrate account, device, and log data. It can also open reverse shells.

What affiliates did with access

Affiliates used the access for ad fraud. Some affiliates ran residential proxy exit nodes. Named proxy services included Linkfog, AppSalt, and NetNut. Other affiliate modules added further backdoors. TrendAI counted 1,472,554 infected devices across 206 models. That count covers June 3 to October 1, 2026.

What the takedown changed, and what it did not

Google took legal action against XCPE control domains. It also acted against control domains of more than a dozen malware families. Google assesses the action will sever criminal access to at least 10 million more devices. The takedown did not clean the infected boxes. The backdoor survives on those boxes today. Google cut ties with Videostrong. Videostrong is banned from building or selling certified Android devices. The ban also covers future subsidiaries and affiliates. It also covers supplying software to certified vendors.

What organizations should do

Disconnect affected boxes from your network now. Block the control domains listed by Google. Segment other smart devices from sensitive systems. Synthient recommends discarding affected boxes. A reset is not listed as a removal method. Record each affected device, its model, and its network location.

The governance lesson

Firmware is part of the system, even when it arrives preloaded. An inventory that omits smart devices misses this risk. Evidence must show the device list, the firmware source, and the removal decision. PolicyCortex does not remove firmware backdoors. PolicyCortex helps teams link proof to requirements.

Sources

Google Cloud blog, Shutting the Door on the XCPE Botnet. https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet/
BleepingComputer coverage, November 2, 2026.
The Hacker News coverage, November 2, 2026.
The Register coverage, November 3, 2026.
Original diagram by PolicyCortex

Next step

Want device and firmware evidence linked to each requirement? See how PolicyCortex collects it from live systems.

Questions on this record

Can owners remove the XCPE backdoor themselves?: No. It reinstalls from the firmware partition on reboot.
Does the takedown clean infected boxes?: No. The backdoor survives on the boxes after the takedown.
How many devices were enrolled?: More than 1.3 million Android devices were enrolled.
What should organizations do first?: Disconnect affected boxes and block the control domains.

Related records

Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page.

proof.state: Proof of State. What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
proof.change: Proof of Change. Who or what altered the environment, under what authority, with before and after state hashes.
proof.agency: Proof of Agency. What a machine was permitted to do before it acted, what it did, and what would have stopped it.
architecture: Architecture. How the chain is built and where it lives: inside your tenant, with no egress of evidence.