Welcome to the November 4, 2026 edition. Today’s lineup has a botnet story with a villain hiding in the hardware supply chain, plus a creator-gear deal that could make mouse-drawn graphics a thing of the past. One small box brought a very large security lesson.
Security Brief
Google and its partners say they dismantled the XCPE backdoor and botnet, which had enrolled more than 1.3 million devices, mostly Android TV set-top boxes. Telehealth devices, karaoke machines, and digital signage were also found in the network. The unusual part is who Google says was behind it: with high confidence, Google assesses that Videostrong Technology Co., an Android OEM and ODM, intentionally developed, deployed, and operated the backdoor for financial gain. Google says Videostrong sold access to criminal affiliates, who loaded their own malware modules onto infected devices.
Google says this was not a rogue employee or a coding mistake. The backdoor appeared across different models and brands over several years, supported by dedicated infrastructure and regularly changing configurations. The preloaded system-level backdoor, called x.cpe or com.oemservice in some builds, ran with system privileges. If removed, it could reinstall itself from the /oem/ partition at reboot. It handed work to a loader called com.abc.nexus, which fetched affiliate modules.
Those modules turned compromised devices into residential proxies through kits associated with Linkfog, AppSalt, GaGaNode, BWM, Traffmonetizer, EarnFM, and NetNut. Other modules ran ad fraud: Fission and HiddenView could fake impressions, clicks, scrolling, and other activity. Some affiliates installed additional backdoors, too. Google says certain software enrolled devices silently, without a visible consent screen. In one case, AppSalt’s SDK called an opt-in function without showing consent, and stopped running if the app came from the official Play Store.
The control channel was no simple check-in. Through MQTT, operators could install apps, run commands and scripts, take screenshots, record keystrokes, and map a device’s network. Google also observed the backdoor disabling Google Play Protect’s app verification. A testing gap helped it slip through: the malicious code loaded after first boot, so compatibility and security tests did not catch it. Google says it has cut ties with Videostrong, banning the company, future subsidiaries, and affiliates from making certified Android devices or supplying software to other certified makers. It also pursued legal takedowns of Videostrong’s control domains and servers, along with control domains for more than a dozen malware families. Because affiliates used other distribution channels, Google expects the disruption to cut access to at least 10 million additional compromised devices. The effort involved Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI.
For small businesses, the twist is a supply-chain attack from inside the house: the device maker itself. Certification and Google testing are useful, but this case shows they are not a substitute for vetting connected hardware. Be wary of unusually cheap boxes from unknown listings, and treat apps offering payment for “unused bandwidth” or “sharing your internet” as a serious risk. Google’s consumer checklist is straightforward: stick to trusted app stores, review permissions for third-party VPNs and proxies, keep Play Protect on, buy connected devices from reputable manufacturers, and check the Android TV partner list. Vet the gear, then make things with it.
Desk Upgrade
Today’s creator pick is the HUION Kamvas Pro 16, a 15.6-inch pen display listed at $289.99, down from a $389.99 list price, a 26% discount. Amazon shows a 4.5-star rating from 4,423 reviews, and the item is sold by HUION, the brand’s own store. The deal details come from Mereja.Tech’s November 4 roundup, which checked prices at 7:13 AM ET; sale prices can change at any time.
The appeal is direct: draw on the image instead of steering a mouse around a separate screen. The Kamvas Pro 16 has a fully laminated, anti-glare IPS display with 1920 × 1080 resolution, 120% sRGB color gamut, and a 1000:1 contrast ratio. Full lamination minimizes parallax, so the cursor sits close beneath the pen nib, while the slightly textured glass gives the surface a more paper-like feel. The included battery-free stylus is listed by HUION as the PW507, with 8,192 pressure levels and 60-degree tilt support; six programmable express keys and a touch bar can speed up common actions.
For a small business owner, that hands-on control can help with product graphics, annotated videos, and social content. The thin, professional-looking design makes it a practical desk addition, and at this price it can be a more approachable step into pen displays before considering a higher-priced Wacom setup. It is not a standalone tablet, though: it needs external power and a connection to a computer, with the included cable setup taking up more desk space than a wireless pen tablet.
There are trade-offs worth knowing before checkout. Some reviews report driver setup issues, occasional lag or flickering, and other responsiveness hiccups. Color may look oversaturated or uncalibrated out of the box, so professional color work calls for manual calibration. Also note that HUION’s current Amazon listing identifies the included pen as a PW507 with PenTech 2.0, not the PW517/PenTech 3.0 sometimes listed in product descriptions elsewhere, so check the exact model details before buying. The day’s lesson carries over: vet the gear, then use it to make something worth sharing.
Daily Links
Security Brief
- BleepingComputer: Google disrupts million-device XCPE Android malware botnet and bans TV box maker
- Security Affairs: Inside XCPE, the botnet that turned set-top boxes into proxy servers
- Google Cloud: Shutting the Door on the XCPE Botnet
- KrebsOnSecurity: Tech firms dismantle botnet that turned 1.3 million TV boxes into proxies
Desk Upgrade
Grow with Network Repair1
Network Repair1 has reached 13,000 YouTube subscribers and 1.1M+ lifetime views. Subscribe and follow along for technology tutorials, product coverage, and useful tips to support your work and grow your digital presence.
Promote with Network Repair1
- 🎬 Shopify and Amazon product videos: We create engaging videos to showcase products and boost social content.
- 🖥️ Remote IT support: We help troubleshoot computers, networks, and Microsoft 365 remotely.
- 🤝 Collaborate: Let’s work together to create useful content and grow your brand.
Ready to upgrade your tech? Check out our curated list of essential tools to keep you connected and productive.
The items mentioned are featured on the YouTube channel.
https://www.amazon.com/shop/networkrepair1?ref_=cm_sw_r_cp_ud_aipsfshop_XV0ER95A5EVVJDPA7W6A_1
805-723-9608
▶️ https://www.youtube.com/@NetworkRepair1
🎵 https://www.tiktok.com/@networkrepair1
📸 https://www.instagram.com/networkrepair1/?hl=en
📘 https://www.facebook.com/networkrepair1/
Leave a Reply