Sub-Total: $0.00
Australia’s Digital Signage devices under attack
5 November 2026
According to a recent Google Report, Google, Japanese police and five companies have detected, exposed and shut down a global botnet called XCPE, which has potentially compromised around 1.5 million Android devices worldwide, including TV boxes and digital signage devices.
Assisting Google in uncovering the extent of the cybersecurity breach, Trend AI has counted about 1.47 million infected devices from June to early October. While most are in Malaysia, Brazil, Iraq, Mexico and Taiwan, Germany, the U.S., the U.K., Australia and Canada each had roughly 26,000 to 42,000 and Trend AI says the actual numbers are likely higher.
Google has identified the breach back to Shenzhen-based manufacturer Videostrong. The company allegedly built a backdoor – a hidden remote access point – into its own firmware and then, according to Google, monetised the backdoor by selling access to criminal affiliates and loading those affiliates’ malware modules onto infected devices. These secondary modules were conducting ad-fraud; silently enrolling infected devices into residential proxy networks; and loading additional malware onto XCPE-compromised devices. Because these affiliates each have diversified distribution channels for their modules beyond XCPE, Google assessed that taking down their C2 domains effectively severed access to at least 10 million additional compromised devices. Videostrong is now banned from building certified Android devices.
While the command servers have now been taken offline, Trend AI says that the backdoor remains in the firmware and if deleted, it reinstalls itself on reboot, so the only course of action available is to replace the infected devices. Google and Trend AI accordingly recommend that all network operators and integrators using low-cost Android boxes or white-label hardware should now run their own checks, noting that Android certification alone is not sufficient proof. Another partner, Plume, confirms that the backdoor also hit certified devices and Synthient found it on Mecool-branded boxes and have already published 182 suspicious model names.
The net result of all this is that without users’ knowledge or consent, infected devices were offered as a distribution mechanism for a wide array of criminal actors. This led to a variety of malicious activities being conducted on and through the devices, including ad-fraud, data exfiltration, and routing malicious network traffic through the devices. Whilst Google’s intervention has now shut down this botnet, the over-arching issue here is that digital signage, security is fast becoming a supply chain issue.
For more information, please refer to the associated Google Report on this incident.
