Backdoored Android Devices Powered a 1.3 Million-Device Botnet
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Thursday, November 5th, 2026.
More than 1.3 million Android-based set-top boxes and other connected devices were turned into infrastructure for criminal activity. Google attributed the XCPE operation with high confidence to manufacturer Videostrong. It alleged that a backdoor was embedded across multiple models and brands. Criminal affiliates then used the access for ad fraud, residential proxy services and additional malware.
Legal and technical action disrupted control systems, and Google barred the manufacturer from its certified Android ecosystem. But the broader risk remains important. Traffic from compromised consumer devices can appear legitimate, weakening defenses based on location or I P reputation.
Business exposure increases when televisions, digital signage or telehealth equipment share networks with sensitive systems. Leaders should give connected devices clear ownership and require stronger supplier assurance. Defenders should segment those devices, watch for unusual outbound traffic and avoid untrusted applications that pay users to share bandwidth.
The larger lesson is that low-cost devices can become durable attack infrastructure far beyond their owners. Inventory Android-based connected equipment, isolate it from sensitive networks and replace products that don’t have a trustworthy support path.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
