BADBOX-style Supply Chain Botnet: 1.3M Android TV Boxes Shipped Pre-Infected with XCPE Malware, Brazil Second Most Affected
Google, together with Trend Micro, Lumen, HUMAN Security, Plume, Synthient, TrendAI and Japan's National Police Agency, dismantled a global botnet operation involving more than 1.3 million devices infected with malware dubbed XCPE. The affected devices—mostly Android TV boxes, but also telemedicine equipment and digital signage hardware—shipped pre-infected directly from the factory, with no user interaction required. Brazil ranked as the second most affected country, behind Malaysia, with compromised devices found in 170 countries overall, including Iraq, Mexico and Taiwan. Chinese manufacturer Videostrong, based in Shenzhen, intentionally embedded the malware in devices since late 2024 and sold criminals access to the infected fleet, which was used for ad fraud via simulated ad views. Videostrong evaded Google's Android compatibility and security checks, loading the malicious code only after first device boot. Google has cut ties with Videostrong, banned it from producing or selling certified Android devices, and revoked its ability to supply software to other certified manufacturers.
Detalhes técnicos
The XCPE malware was embedded at the manufacturing stage by Videostrong, bypassing Google's standard Android device compatibility and security testing (CTS/Play Protect-type checks). Infection did not rely on phishing or user clicks since compromise occurred before first boot. The botnet was monetized through ad fraud, simulating ad impressions on the infected device fleet to generate fraudulent advertising revenue.
Remediação
Google revised its device review process to better detect such pre-installed threats. In Brazil, Anatel (Agência Nacional de Telecomunicações) warned that use of uncertified/unhomologated devices poses risks beyond consumer safety, potentially threatening national telecommunications infrastructure, and reiterated its ongoing efforts against the sale of non-homologated equipment, though it was not part of the Google-led operation.
Linha do tempo
-
BADBOX-style Supply Chain Botnet: 1.3M Android TV Boxes Shipped Pre-Infected with XCPE Malware, Brazil Second Most Affected
ler a análise desta fonte ocultar
Google, together with Trend Micro, Lumen, HUMAN Security, Plume, Synthient, TrendAI and Japan's National Police Agency, dismantled a global botnet operation involving more than 1.3 million devices infected with malware dubbed XCPE. The affected devices—mostly Android TV boxes, but also telemedicine equipment and digital signage hardware—shipped pre-infected directly from the factory, with no user interaction required. Brazil ranked as the second most affected country, behind Malaysia, with compromised devices found in 170 countries overall, including Iraq, Mexico and Taiwan. Chinese manufacturer Videostrong, based in Shenzhen, intentionally embedded the malware in devices since late 2024 and sold criminals access to the infected fleet, which was used for ad fraud via simulated ad views. Videostrong evaded Google's Android compatibility and security checks, loading the malicious code only after first device boot. Google has cut ties with Videostrong, banned it from producing or selling certified Android devices, and revoked its ability to supply software to other certified manufacturers.
Technical Details
The XCPE malware was embedded at the manufacturing stage by Videostrong, bypassing Google's standard Android device compatibility and security testing (CTS/Play Protect-type checks). Infection did not rely on phishing or user clicks since compromise occurred before first boot. The botnet was monetized through ad fraud, simulating ad impressions on the infected device fleet to generate fraudulent advertising revenue.
Remediation
Google revised its device review process to better detect such pre-installed threats. In Brazil, Anatel (Agência Nacional de Telecomunicações) warned that use of uncertified/unhomologated devices poses risks beyond consumer safety, potentially threatening national telecommunications infrastructure, and reiterated its ongoing efforts against the sale of non-homologated equipment, though it was not part of the Google-led operation.