Google shuts down global botnet running on certified Android devices

The XCPE botnet demonstrates how supply chain trust can be weaponised: Videostrong Technology, a certified Android device manufacturer, pre-installed malware on over 1.3 million devices before they ever reached consumers, bypassing the assumption that certified hardware is safe. Because the malicious code was baked into firmware by an approved vendor, traditional endpoint defences and user behaviour had no opportunity to intervene. This incident matters because it shows that certification programmes alone are insufficient — continuous behavioural monitoring of certified partners and their devices is essential. The scale of ad fraud, data theft, and traffic routing achieved highlights how deeply a supply chain compromise can affect end users who had no reasonable way to detect the threat.