Google finds malware in 1.3 million Android devices
The malware, identified as XCPE, was allegedly installed by Chinese manufacturer Videostrong Technology in various Android-based devices.
Google has uncovered a malware operation affecting more than 1.3 million Android-based devices, according to a report by WION. The company identified the malware as XCPE, which was allegedly embedded in firmware by Shenzhen-based Videostrong Technology during the manufacturing stage.
The backdoor allowed attackers to gain system-level access to devices, enabling them to capture screens, collect device and account information, and install applications silently. Once active, the malware could turn infected devices into a botnet used for data theft, advertising fraud, and unauthorised internet traffic routing.
While most infections were found on Android TV set-top boxes, Google also identified the malware on digital signage systems, karaoke machines, and telehealth devices. The campaign impacted several brands and models across more than 200 countries over multiple years.
Google has banned Videostrong from supplying software or building certified Android devices. The company worked with several partners, including Japan's National Police Agency and Lumen, to target the infrastructure controlling the botnet and disrupt access to at least 10 million other compromised devices.
Google stated it assessed with high confidence that the operation was intentionally developed for financial gain. The company is currently strengthening firmware integrity checks and has advised consumers to purchase connected devices from reputable manufacturers.