On 2 November 2026 Google announced it had dismantled XCPE, a botnet of more than 1.3 million Android devices whose manufacturer built the backdoor into factory firmware. Most were TV boxes, but Google confirms digital signage players were infected too. If cheap unbranded Android boxes drive your screens, audit and replace them this month.
Key takeaways
- XCPE infected more than 1.3 million Android devices, and Google says digital signage devices were among them.
- The backdoor was installed at the factory by the device maker, so buying “new” did not protect you.
- The takedown cut off the criminals’ servers but did not clean the devices, and a factory reset does not remove the malware.
- Put every signage player on its own network segment and replace any box whose maker you cannot identify.
What happened with the XCPE botnet?
Google and partners cut the control servers of a botnet that a device maker ran on purpose. SecurityWeek reports the backdoor was developed and operated by Videostrong Technology, a China-based OEM and ODM of Android devices.
Videostrong sells boxes under its own name and builds them for other brands, according to The Hacker News. Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI worked on the operation.
Google also says it severed access to at least 10 million more compromised devices, and it banned Videostrong and its future affiliates from making certified Android devices, as BleepingComputer details.
Were digital signage players really affected?
Yes. Google’s report lists “telehealth devices, karaoke machines, and digital signage devices” next to the TV boxes. invidis notes that Google gave no counts or model names for the signage hardware.
That gap is the problem. You cannot look up your model on a list, so you have to check your own fleet.
Why this matters if you run screens
The infected box keeps working as a player, so nobody on staff notices. Meanwhile it earns money for someone else through ad fraud and by renting out your internet connection as a proxy exit node.
What that means in a store or office:
- Your public IP can end up on blocklists, and staff start seeing captchas or blocked payment gateways.
- On a metered 4G router, background proxy traffic eats the data plan.
- The backdoor installs apps silently and switches off Play Protect checks, so the device is no longer under your control.
- A player on the same Wi-Fi as your tills or office PCs gives an attacker a way into that network.
A gym with 6 screens on guest Wi-Fi faces mostly a bandwidth and reputation issue. A 20-store retailer whose marketplace boxes share a network with POS terminals has a compliance problem.
How do you check your own players?
Start with an inventory, then isolate, then replace. Plan about 15 minutes per site.
- Record brand, model, Android version and the seller for every box. Settings, then About, usually shows the build.
- Check the brand against Google’s Android TV partner list, which ITdaily reports Google now advises buyers to use. Remember Videostrong itself was certified, so this is a minimum bar, not proof.
- Look at router logs for steady upload traffic at 3 a.m. when screens are off.
- Move players to a separate VLAN or SSID and allow only your CMS domains outbound.
- Replace suspect boxes. A reset will not help: the malware reinstalls itself from the device’s /oem/ partition.
For more fault-finding steps, see our guide on troubleshooting digital signage problems.
Which replacement player makes sense?
Pick hardware where you know who writes the firmware and how it gets updated.
| Option | Who controls firmware | Price | Best for |
|---|---|---|---|
| Look Verde PRO | Look DS, firmware pre-installed | $149 | Look DS users replacing boxes on existing TVs |
| Display with built-in SoC (Tizen, webOS) | Display maker | Included in screen | New screen purchases |
| Major-brand stick (Amazon Signage Stick) | Platform owner | Varies | Fleets on a supported CMS |
| Unbranded marketplace Android box | Often unknown ODM | Low | Avoid |
The Look DS players ship with Look firmware pre-installed, background updates and a hardware watchdog that restarts a frozen unit. The older HD-2222 Lite sells for $139. Compare options in our digital signage players guide and the Tizen vs webOS breakdown. Budget the swap too: we cover replacement costs in hidden costs of digital signage.
Disclosure: Digital Signage Trends is published by Look Digital Signage.
FAQ
Is my Samsung or LG signage screen affected?
None of the reports we reviewed name Samsung Tizen or LG webOS displays. XCPE was built into Android firmware from Videostrong. Built-in SoC screens run their maker’s own OS, so they are a separate case.
Does a factory reset remove XCPE?
No. BleepingComputer reports the malware reinstalls itself from the /oem/ partition after removal. Treat any confirmed device as hardware to retire.
How do I know if Videostrong made my box?
Often you cannot, because it builds devices for other brands. Synthient traced the backdoor after finding it on a MECOOL KM9PRO Max box. If the seller cannot tell you who made the hardware, replace it.
Can the botnet change what my screens show?
The backdoor can install apps silently, so in theory the device is open to anything. Reported uses were ad fraud, proxy rental and loading more malware. Network isolation limits the damage while you replace hardware.
What is a botnet?
A botnet is a group of internet-connected devices that someone controls remotely without the owner knowing. Operators use them to fake ad views, relay other people’s traffic or launch attacks.
Sources
- Google Dismantles XCPE Botnet of 1.3 Million Android Devices - SecurityWeek
- Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access - The Hacker News
- Google disrupts million-device XCPE Android malware botnet, bans TV box maker - BleepingComputer
- Cybersecurity: Google Takes Down Global Android Botnet - invidis
- Google takes botnet of 1.3 million devices offline - ITdaily
- Google dismantles 1.3 million-device Android malware botnet - Dataconomy
