A coordinated effort involving Google and multiple security partners has disrupted the XCPE malware botnet, which compromised more than 1.3 million Android TV streaming devices. Google attributes the operation with high confidence to Videostrong Technology Co., a Chinese manufacturer, alleging the company deliberately embedded a persistent backdoor into its devices and sold access to criminal operators seeking to profit from cybercriminal ventures.
Criminal affiliates leveraged the backdoored devices to deploy malicious modules for ad fraud schemes, convert infected hardware into residential proxies, and distribute additional malware. As part of the disruption, Google disabled XCPE command-and-control infrastructure used by more than a dozen related malware families, severing connections to at least 10 million additional compromised devices spanning retail set-top boxes, karaoke machines, and telehealth equipment—not all of which run Android.
Google has severed its relationship with Videostrong, revoking the manufacturer's license to produce Android TV devices with preloaded Google applications and services. The company and any future affiliates are now barred from manufacturing certified Android devices or supplying software to certified vendors.
We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.
Google's Threat Intelligence Group (GTIG)
The disruption involved Japan's National Police Agency alongside security organizations Lumen, HUMAN Security, Plume, Synthient, and TrendAI, which coordinated analysis of the malicious infrastructure and execution of takedown operations.
The XCPE botnet
Unlike typical botnets that exploit vulnerabilities or deceive users into installing malware, XCPE was embedded directly into device firmware at the manufacturing stage. Google indicates that Videostrong developed and distributed the malware across numerous device brands and models over an extended period, continuously refining its capabilities to evade detection and accommodate different criminal operators.
We found this malicious software built directly into many different device models and brands over multiple years, supported by dedicated infrastructure and constantly evolving configurations to evade detection and manage their affiliates.
The primary backdoor component, identified as x.cpe and com.oemservice, operates with Android system-level privileges. The malware employs a modular design separating backdoor functionality from revenue-generating modules operated by affiliates.
Upon device startup, XCPE connects to a command-and-control server on the anyevonline[.]com domain to retrieve connection details and credentials for an MQTT message broker, subsequently used for command reception. Google notes that the malware uses distinct subdomains of anyevonline[.]com based on Android version and device type. The MQTT broker, hosted at mqtt.szbboys[.]com, enabled operators to transmit commands and deploy additional malware to compromised devices.
Through this infrastructure, operators gain remote control over infected devices to execute malicious functions:
- Covertly download and install additional Android applications
- Disable Google Play Protect
- Execute shell commands and scripts with system privileges
- Capture screenshots and inject keystrokes
- Collect account credentials, device information, installed application inventories, and system logs
- Perform network reconnaissance and establish reverse shells
Infected devices also generated revenue by hosting malware modules from other operators, transforming the backdoor into a plug-in cybercrime platform accessible to multiple criminal groups. These modules included software tied to residential proxy services including Linkfog, AppSalt/Honeygain, GaGaNode, NetNut, and Traffmonetizer, which routed third-party internet traffic through infected devices without owner knowledge or authorization.
Additional modules engaged in ad fraud by generating ad impressions, loading concealed webpages, and clicking advertisements. Some modules installed supplementary backdoors—Moyu, Spirit, and Bird—to facilitate download and execution of further malware.
Botnet operators continuously modified the malware's structure to prevent detection. In late 2024, Videostrong introduced a separate loader called com.abc.nexus, which executed malicious modules while XCPE maintained C2 communications. Beginning in August 2026, operators started replacing that loader with smaller, specialized droppers masquerading as Android system applications.
Videostrong attribution
Cybersecurity firm Synthient independently connected the XCPE backdoor and infrastructure to Videostrong after discovering the malware preinstalled on a MECOOL KM9PRO Max Android TV box acquired in late 2025. Investigation revealed a publicly accessible directory on the malware's file.anyevonline[.]com server containing backdoors used by operators, alongside a PDF folder with a document authored by Owen Cao, R&D director at Videostrong Technology Co.
Synthient also identified that Videostrong's videostrong[.]cn domain resolved to the same IP address as mqtt.anyevonline[.]com, the command-and-control server enabling operators to enumerate compromised devices, distribute commands, and oversee application deployments. Furthermore, researchers discovered that numerous Videostrong company email addresses had signed the backdoors.
Google assesses the evidence demonstrates deliberate malware installation by the manufacturer rather than unauthorized action by a single employee or development error.
We believe this campaign wasn't an isolated rogue insider or a development oversight.
Google has modified its certification review procedures following discovery that Videostrong employed obfuscation to bypass security testing and load malicious code after initial device boot. While the takedown has disrupted XCPE operations, the malware persists on infected devices and automatically reinstalls itself from the /oem/ partition if removed.
Users must install clean firmware to eliminate the infection or disconnect affected devices from the internet to halt further malicious activity.