Google has collaborated with a range of partners, including the National Police Agency (NPA) of Japan, to successfully shut down a Chinese company that implanted a “XCPE backdoor” in internet-connected devices. This backdoor turned over 1.3 million devices produced by the company into what are known as “residential proxies,” which were further infected with malicious software.
Residential proxies serve as intermediary services that forward internet traffic through residential internet connections. Cybercriminals often exploit these services to mask their real identities, enabling them to conduct malicious activities or steal and collect personal data undetected.
In a blog post published on November 3, Google disclosed that it, alongside the NPA and other partners, dismantled a network of backdoors and compromised devices created by Shenzhen-based Videostrong Technology. The affected devices included Android TV set-top boxes, as well as other internet-connected products that run on the Android system, such as karaoke machines, telemedicine equipment, and digital signage devices.
Google emphasized that the backdoor established by Videostrong Technology was “deliberately developed, deployed, and operated for financial gain.” The company speculated that Videostrong sold access to these devices to criminal entities and assisted in loading malware modules onto them.
The blog post also noted that investigators observed operators of Videostrong executing various malicious operations using these compromised devices. These included intercepting real-time screen images, injecting keystrokes, and stealing sensitive data such as account details and device information.
According to Google, this malware had been directly implanted in several different models and brands of devices over the past few years. The operators behind this malicious scheme maintained specialized infrastructure and continuously updated their configurations to evade detection and manage their associated criminal networks.
“We believe this is not a case of individual insiders’ misconduct nor is it simply a development oversight. Therefore, Google has terminated its partnership with Videostrong and banned the company from producing devices pre-installed with Google applications,” the blog stated. “The deliberate injection of malware into user devices by the manufacturer is not only a severe breach of trust but also poses significant risks to users. These infected devices have unknowingly become tools for various criminals to distribute malware, all without the users’ awareness or consent.”
In response to this operation, Google announced legal actions to take down domains and servers used by Videostrong to control the botnet and install malware modules. Furthermore, it has prohibited Videostrong and its future subsidiaries or affiliates from manufacturing and selling certified Android devices, as well as from providing software to other certified manufacturers.
As per the Japanese National Police Agency, this case was initially uncovered by the Fukuoka Prefectural Police in September 2025. The police had discovered the infected internet devices while investigating an unauthorized online bank transfer case.
Subsequently, the Cyber Special Investigation Unit of the Kanto Regional Police Bureau determined the manufacturing and sales of these devices and relayed relevant information to Google. In July, the NPA issued a warning regarding the risks associated with using smart TVs, digital photo frames, routers, and network cameras as “residential proxies.” They urged consumers not to download or use software, applications, or free VPN services from unknown or unverified providers. The police also advised the public to remain vigilant when interacting with free streaming services or services that offer compensation in exchange for sharing internet bandwidth.
Residential proxies significantly complicate the detection of cyberattacks and make tracing their origins more challenging. According to the NPA, of the unauthorized online banking transfer cases reported in 2024, 1,918 involved residential proxies, resulting in economic losses amounting to approximately 2.89 billion yen (about 18.3 million USD).