Google shuts down XCPE botnet and bans TV box maker Videostrong

Google’s Threat Intelligence Group, working with Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI, took apart the XCPE botnet in late October 2026, after malware was embedded in the firmware of more than 1.3 million Android TV set-top boxes during manufacturing.

Google attributes the botnet with high confidence to Videostrong Technology Co., saying the manufacturer deliberately embedded a backdoor in device firmware to generate revenue through cybercrime. Google said its evidence indicates Videostrong deliberately installed the malware, rejecting the possibility that a single employee acted alone or that an accidental coding error placed the backdoor on devices.

Criminal affiliates bought access to infected devices from Videostrong and used the boxes to commit ad fraud, to run residential proxy services, and to install additional malware. Ad fraud means fake impressions or clicks are generated to inflate revenue or defraud ad networks. Residential proxy services send internet traffic through home networks, often without the user’s knowledge or consent, to hide where the traffic comes from.

In late October 2026, Google shut down the command-and-control servers for XCPE, cutting off the infected devices and cutting access for at least 10 million other compromised devices. The broader disruption reached karaoke machines, telehealth hardware, and retail set-top boxes, not all running Android, that had been infected through different malware channels.

The XCPE malware runs with Android system-level privileges, installs itself again from a protected partition after removal, and disables Google Play Protect, which verifies app safety before installation, to evade detection. It contacts command-and-control servers over HTTP and MQTT, a lightweight messaging protocol used in IoT devices, receiving orders for silent app installs, shell commands, and network reconnaissance.

Infected boxes contact an anyevonline.com command domain to get MQTT broker details, and mqtt.szbboys.com hosts the broker. TrendAI counted 1,472,554 infected devices across 206 models between June 3, 2026 and October 1, 2026, with the heaviest concentration in Malaysia, Brazil, Iraq, Mexico, and Taiwan.

The malware infected telehealth devices, karaoke machines, digital signage devices, and Android TV set-top boxes, most of them TV boxes. Synthient linked the XCPE backdoor to Videostrong after finding malware preloaded on a MECOOL KM9PRO Max Android TV box bought in late 2025.

The firm also discovered a publicly accessible directory on file.anyevonline.com holding backdoors, plus a PDF folder with a document written by Owen Cao, the research and development director at Videostrong. Videostrong’s videostrong.cn domain sat on the same IP address as mqtt.anyevonline.com, and backdoors were signed with company e-mail addresses.

Videostrong ran a separate loader called com.abc.nexus starting in late 2024 to execute malicious modules while XCPE managed command-and-control traffic. In August 2026, operators swapped that loader for compact droppers made to look like Android system apps. The changes reflect a shift to modular architectures and specialized droppers intended to evade detection and maintain persistence.

According to Google, operators could silently install applications, turn off Google Play Protect, run shell commands with system privileges, capture screenshots, inject keystrokes, gather account and device data such as installed application lists and system logs, and carry out network reconnaissance and reverse shells. The backdoor also let operators exfiltrate sensitive data.

Affiliate modules bundled residential proxy software from NetNut, Traffmonetizer, Linkfog, AppSalt, and Honeygain, along with ad-fraud tools that generate impressions and clicks. The modules also included GaGaNode. The affiliate modules also included extra backdoors called Moyu, Spirit, and Bird. Google said the backdoor worked as a plug-in platform, letting other cybercriminals make money from infected boxes by routing traffic and running fake ads.

To get past Google’s security testing, Videostrong used obfuscation techniques that hide a program’s true purpose, loading malicious code only after the first device boot. The tactics prompted Google to update its certification review process.

Google barred Videostrong, along with its future subsidiaries and affiliates, from making certified Android devices or supplying software to certified vendors. Google also ended ties with Videostrong and took away its license to build Android TV devices that come with preloaded Google apps and services.

Google said shutting down the infrastructure cannot remove the malware from infected devices, so owners should pull affected devices off the internet to stop further malicious activity. Synthient recommends that owners disconnect and retire affected devices because additional malware installations carry a high risk.

The reports highlight the risks that supply-chain compromises pose in consumer hardware, including the need for stronger checks on firmware integrity. Google said the disruption will not eliminate the threat entirely, since backdoor operators and affiliates may adapt with new tools.

“Group action, as exemplified in this operation, interrupts the infrastructure needed for monetisation,” said Gavin Reid, CISO at HUMAN Security. “Operations like this raise the cost for criminals and show that the infrastructure they rely on isn’t out of reach,” said Charley Snyder, Head of Disruption Operations at Google’s Threat Intelligence Group.