Google and its industry partners have disrupted the XCPE malware botnet, which infected more than 1.3 million Android TV streaming boxes. Google says the devices were deliberately infected during manufacturing to generate revenue through cybercrime, including ad fraud, residential proxy services and the distribution of additional malware. The company attributes the operation with high confidence to Chinese device manufacturer Video Strong Technology, also known as Videostrong.
As part of the disruption, Google took down the XCPE command-and-control (C2) server used by more than a dozen related malware families. The operation also cut off access to at least 10 million additional compromised devices infected through malware other than XCPE.
Those additional devices included retail store set-top boxes, karaoke equipment and telemedicine hardware. Google said that not all of the affected devices were running Android.
Google ended its relationship with Videostrong, revoked the company’s license to manufacture Android TV devices preloaded with Google apps and services, and barred Videostrong and any future affiliates from manufacturing certified Android devices or providing software to certified vendors.
“We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated by Videostrong Technology for financial gain,” Google’s Threat Intelligence Group (GTIG) said in a report released Monday.
The disruption involved Japan’s National Police Agency and cybersecurity companies Lumen, HUMAN Security, Plume, Synthient and TrendAI. The organizations worked together to analyze the malicious infrastructure and disrupt its operations.
XCPE was built into device firmware
Unlike botnets that typically compromise devices by exploiting software vulnerabilities or tricking users into installing malicious applications, XCPE was embedded directly into device firmware during manufacturing.
Google said Videostrong had developed and distributed malware across multiple device brands and models over several years. The operation evolved its infrastructure and capabilities to evade detection and support different criminal organizations.
“We discovered that this malicious software has been built directly into many different device models and brands over the years, supported by dedicated infrastructure, and supporting constantly evolving configurations to evade detection and manage affiliates,” Google said.
The primary backdoor components, tracked as x.cpe and com.oemservice, run with Android system-level privileges. The malware uses a modular architecture that separates the core backdoor from modules used by affiliates to generate revenue.
When an infected device starts, XCPE connects to anyevonline[.]com to obtain connection information and credentials for an MQTT message broker. The broker, hosted at mqtt.szbboys[.]com, allows operators to send commands to infected devices and deploy additional malware. Google said the malware uses different subdomains of online[.]com depending on the Android version and device type.
Through this infrastructure, operators can remotely control compromised devices and perform actions including:
- Silently downloading and installing additional Android applications.
- Disabling Google Play Protect.
- Running shell commands and scripts with system privileges.
- Capturing screenshots and recording keystrokes.
- Collecting account information, device details, installed-application lists and system logs.
- Conducting network reconnaissance and establishing a reverse shell.
Malware modules supported multiple criminal operations
The infected devices served as a plug-in cybercrime platform. Operators could install modules belonging to other criminal groups, allowing affiliates to use the backdoor for different revenue-generating activities.
Google identified modules associated with residential proxy services including Linkfog, AppSalt/Honeygain, GaGaNode, NetNut and Traffmonetizer. These services routed third-party internet traffic through infected devices without the owners’ knowledge or consent.
Other modules conducted ad fraud by generating fraudulent ad impressions, loading hidden web pages and clicking advertisements. Additional backdoors, including Moyu, Spirit and Bird, could download and execute further malware.
Google said the botnet operators continually modified the malware architecture to avoid detection. In late 2024, Videostrong began using another loader, com.abc.nexus. While XCPE focused on communicating with the C2 infrastructure, this loader executed malicious modules.
Beginning in August 2026, the operators started replacing those loaders with small, specialized droppers disguised as Android system applications.
Evidence linking the botnet to Videostrong
In a separate report, cybersecurity company Synthient described how it traced the XCPE backdoor and its infrastructure to Videostrong. The investigation began after researchers discovered the malware pre-installed on a MECOOL KM9PRO Max Android TV box purchased in late 2025.
Synthient found a publicly accessible directory above the malware directory at file.anyevonline[.]com, a server hosting backdoors used by the operators. The directory also contained a PDF folder with a document authored by Owen Cao, Videostrong Technology Co.’s director of research and development.
The researchers also found that several Videostrong domains, including videostrong[.]cn, pointed to the same IP address as mqtt.anyevonline[.]com. That C2 server allowed operators to list compromised devices, send commands and manage application installations.
Additionally, Synthient found that several Videostrong email addresses had been used to sign the backdoor.
Google said the combined evidence indicates that the malware was intentionally installed by the manufacturer rather than introduced by a rogue employee or as the result of a development mistake.
“We believe this campaign is not the result of an isolated rogue insider or a developmental oversight,” Google said in a statement.
Google also said it changed its certification review process after discovering that Videostrong used obfuscation techniques to bypass security tests and load malicious code after devices completed their initial boot.
Infected devices require clean firmware
Google’s disruption interrupted the XCPE operation, but it did not remove the malware from infected devices. According to Google, the malware will be automatically reinstalled from the /oem/ partition if users delete it.
Users should install clean firmware to remove the infection, or disconnect affected devices from the internet to prevent further malicious activity.
BleepingComputer has contacted Google with additional questions about the botnet and will update the report if the company responds.
Source: www.bleepingcomputer.com