Google Dismantles Android Botnet That Infected Digital Signage Devices
2026-11-04 · via invidis
Google, Japanese police and five security partners have taken down a global botnet that infected more than 1.3 million Android devices, including digital signage hardware, through a backdoor built into the devices' own firmware. For operators running Android-based players, this is a supply chain problem, not just an antivirus one.
The botnet, which Google calls XCPE, ran mainly on low-cost TV boxes, but Google's report also lists digital signage devices among the infected hardware. Google did not give numbers or models for the signage devices specifically.
Google blames Shenzhen-based manufacturer Videostrong, saying the company built a hidden remote access point into its own firmware and then sold that access to criminals. According to Google, the criminals used the backdoor to route third-party traffic through infected devices' internet connections and to fake ad views. Google has banned Videostrong from building certified Android devices going forward.
Security partner Trend AI counted about 1.47 million infected devices between June and early October, concentrated in Malaysia, Brazil, Iraq, Mexico and Taiwan, with Germany, the US, UK, Australia and Canada each showing roughly 26,000 to 42,000 infections. Trend AI says actual numbers are likely higher than what was measured.
Why certification isn't enough
Partner Plume says the backdoor also turned up on devices that carried Android certification, meaning that badge alone is not proof a device is clean. Synthient identified the backdoor on Mecool-branded boxes and published a list of 182 suspicious model names, but cautions that a model name by itself does not confirm infection. The firm recommends operators check firewall logs against the domains and IP addresses listed in Google's report.
The command-and-control servers behind XCPE are now offline, but the backdoor code itself remains embedded in affected firmware. According to Trend AI, deleting it does not help because it reinstalls on reboot. Only action from the manufacturer or platform, or outright replacement of the hardware, resolves it. The partners are advising operators to take suspicious devices offline in the meantime.
Google is also recommending that smart devices sit on separate network segments from corporate systems, since a compromised player can serve as an entry point into a wider network. The company says retailers and distributors should start requiring independent security audits from contract manufacturers before deploying hardware.
For digital signage networks running on white-label or budget Android boxes, which make up a meaningful share of installed media players, this case is a reminder that firmware provenance now matters as much as price or specs. The announcement does not say which signage brands or CMS platforms, if any, were affected, leaving operators to do their own checking against the indicators Google and its partners have published.
The announcement in full
Reproduced from invidis for reference. Digital Signage Magazine did not write the text below.
More than a million Android devices served criminals through their own firmware. Digital signage hardware was among the infected devices.
Google, Japanese police and five companies have detected, exposed and shut down a global botnet. Partners included Lumen, Synthient and Trend AI.
The network, called XCPE, comprised more than 1.3 million Android devices. Besides TV boxes, digital signage devices were also infected, according to Google’s report . Google gave no further details on numbers or models.
Google blames Shenzhen-based manufacturer Videostrong. The company allegedly built a backdoor, a hidden remote access point, into its own firmware. According to Google, Videostrong sold that access to criminals. They routed third-party traffic through the devices’ internet connections and faked ad views. Videostrong is now banned from building certified Android devices.
Security provider Trend AI counted about 1.47 million infected devices from June to early October. Most are in Malaysia, Brazil, Iraq, Mexico and Taiwan. Germany, the U.S., the U.K., Australia and Canada each had roughly 26,000 to 42,000.
Trend AI says the actual numbers are likely higher. Google’s world map, which has no legend, shows the United States among the few shaded countries such as Canada or Germany.
Network operators and integrators using low-cost Android boxes or white-label hardware should check first. Android certification alone is not sufficient proof. Partner Plume says the backdoor also hit certified devices. Synthient found it on Mecool-branded boxes and published 182 suspicious model names.
According to Synthient, a model name alone does not prove infection. Operators can search their firewall logs for the domains and IP addresses listed in Google’s report.
The command servers are offline, but the backdoor remains in the firmware. If deleted, it reinstalls itself on reboot. According to Trend AI, only action by the manufacturer or platform, or replacing the devices, will help. The partners advise taking suspicious devices offline.
Smart devices should also run on separate network segments. A compromised player can serve as an entry point to the corporate network . According to Google, retailers and distributors should require independent security audits from contract manufacturers.
Google’s intervention shut down the botnet, but the question of where the firmware comes from remains with operators. For digital signage, security is becoming a supply chain issue.