Google and several industry partners have disrupted the XCPE malware botnet, which the company says was embedded in more than 1.3 million Android TV streaming boxes during manufacturing. Google attributes the operation with high confidence to Chinese device maker Videostrong Technology Co., alleging that the company installed a persistent backdoor and sold access to criminal affiliates for financial gain.
The compromised devices were used for several types of cybercrime. Affiliates deployed modules for advertising fraud, converted the boxes into residential proxies and installed additional malware. Google also took down command-and-control servers used by more than a dozen related malware families, cutting off access to at least 10 million other compromised devices. Those devices included retail set-top boxes, karaoke machines and telehealth hardware, and were not all Android products.
Google has ended its relationship with Videostrong, revoked the company’s authorization to manufacture Android TV devices with preloaded Google applications and services, and barred it and future affiliates from producing certified Android devices or supplying software to certified vendors.
The XCPE malware differed from botnets that typically infect devices through software vulnerabilities or deceptive downloads. According to Google, it was built directly into device firmware and distributed across multiple brands and models over several years. Its primary components, tracked as x.cpe and com.oemservice, operated with Android system-level privileges and used a modular design that separated backdoor capabilities from revenue-generating tools.
After an infected device booted, the malware contacted infrastructure on the anyevonline[.]com domain to obtain connection details and credentials for an MQTT broker hosted at mqtt.szbboys[.]com. Operators could then remotely issue commands and install additional applications, disable Google Play Protect, execute shell commands, capture screenshots, record keystrokes and collect account, device, application and system information. The malware could also conduct network reconnaissance and establish reverse shells.
Google said the platform supported modules linked to residential proxy services including Linkfog, AppSalt/Honeygain, GaGaNode, NetNut and Traffmonetizer. These services routed third-party traffic through infected devices without the owners’ knowledge or consent. Other modules generated fraudulent advertising activity, installed additional backdoors and downloaded further malware.
The operators repeatedly changed the malware to make detection more difficult. In late 2024, they introduced a separate loader named com.abc.nexus, while since August 2026 they had begun replacing it with smaller droppers disguised as Android system applications.
Cybersecurity company Synthient linked the malware and its infrastructure to Videostrong after finding the backdoor preinstalled on a MECOOL KM9PRO Max Android TV box purchased in late 2025. Researchers also identified a publicly accessible directory containing backdoors and a PDF associated with Owen Cao, Videostrong’s R&D director. They found that Videostrong’s domain resolved to the same IP address as an XCPE command-and-control server and that company email addresses had been used to sign the backdoors.
Google said the evidence pointed to deliberate installation by the manufacturer rather than an isolated insider or an accidental development mistake. The company has also changed its certification review process after determining that Videostrong used obfuscation to evade testing and load malicious code after devices completed their initial boot.
Although the disruption affected the botnet’s infrastructure, Google said the malware remains on infected devices. If removed, it can reinstall itself from the /oem/ partition. Users would need to install clean firmware to remove the infection or disconnect affected devices from the internet to prevent further malicious activity.
The operation involved Japan’s National Police Agency and security firms Lumen, HUMAN Security, Plume, Synthient and TrendAI.
Sources: BleepingComputer.