VULNpocalypse
HighBreach / campaignMonitoring

Google disrupts XCPE Android botnet of 1.3 million set-top boxes and bans TV box maker Videostrong

Google and partners took down XCPE, a firmware backdoor that turned over 1.3 million Android set-top boxes into a botnet, and banned maker Videostrong.

Published
Updated
Exploitation
Yes. The backdoor was preinstalled in firmware and actively sold to criminal affiliates for residential proxying, ad fraud and further malware across more than 1.3 million devices over several years (Google via SecurityWeek)

What happened

On Monday 2 November 2026, Google announced it had dismantled XCPE (also written X.CPE), a backdoor and botnet of more than 1.3 million Android set-top boxes (SecurityWeek). Google’s Threat Intelligence Group published the findings in a blog post the same day (Infosecurity Magazine).

Most infected devices were Android TV set-top boxes, but Google also observed infections in other Android based IoT devices including telehealth devices, karaoke machines and digital signage (SecurityWeek). Google says taking down the command and control servers also severed access to at least 10 million additional compromised devices, because the module operators had spread their malware beyond XCPE (BleepingComputer). The same C2 servers had been used by more than a dozen related malware families (Security Affairs).

Who was responsible. Google assesses with high confidence that China based Android OEM and ODM Videostrong Technology Co. built and ran the botnet, saying it was “intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.” (BleepingComputer). Google said this was not the work of a rogue insider or a development oversight (SecurityWeek). Synthient traced the malware to Videostrong after finding it preinstalled on a MECOOL KM9PRO Max box bought in late 2025 (BleepingComputer).

How it got onto devices. Unlike botnets that exploit a vulnerability or trick users, XCPE was built into device firmware during manufacturing, a supply chain infection (BleepingComputer). Videostrong used code obfuscation to pass Google’s compatibility and security tests, loading the malicious code only after the device first boot so the tests missed it (Security Affairs). No CVEs have been assigned (BleepingComputer).

What the malware does. The main backdoor, x.cpe (also seen as com.oemservice), runs with Android system level privileges and reinstalls itself from the /oem/ partition if removed (BleepingComputer). It connects to a C2 server and keeps a live MQTT connection to receive commands (Security Affairs). Operators could silently install apps, disable Google Play Protect, run shell commands, capture screenshots, record keystrokes, collect account and device data, map the victim network and open remote command line sessions (BleepingComputer).

How it was monetized. Videostrong sold access to criminal affiliates, who loaded their own modules (SecurityWeek). Those modules enrolled devices in residential proxy networks (named services include Linkfog, AppSalt/Honeygain, GaGaNode, NetNut and Traffmonetizer), ran ad fraud, and installed additional backdoors (Security Affairs). A single device could run up to three residential proxy kits at once, routing third party traffic through it without the owner consent (Security Affairs).

The takedown. Google took legal action against the domains and servers used for control, and against the control domains of the additional malware families (SecurityWeek). It worked with Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI (BleepingComputer). Google cut all ties with Videostrong, revoked its license to make Android TV devices with preloaded Google apps and services, and banned the company and its future affiliates from producing certified Android devices or supplying software to certified vendors (BleepingComputer). Google also changed its certification review process (BleepingComputer).

It is not over. Google said the underlying illicit market “is resilient,” noting operators can quickly switch to new loaders or rival monetization SDKs (SecurityWeek). The malware was not removed from infected devices; owners need clean firmware to remove it, or must disconnect the device from the internet to stop further malicious activity (BleepingComputer).

Am I affected?

You may be affected if you own a low cost or no-name Android TV set-top box, or another Android based device such as a telehealth unit, karaoke machine or digital signage screen, that could have been manufactured by Videostrong Technology (SecurityWeek). The backdoor was found across many device models and brands over several years (Security Affairs). Synthient specifically found it preinstalled on a MECOOL KM9PRO Max box bought in late 2025 (BleepingComputer).

Warning signs, drawn from the reported behavior (BleepingComputer, Security Affairs):

  • Google Play Protect is disabled or keeps turning itself off.
  • System level apps named x.cpe, com.oemservice or com.abc.nexus are present.
  • The device shows unexplained network traffic even when idle, consistent with proxy or ad fraud activity.
  • Apps appear that you did not install.

The exact list of affected consumer brands beyond MECOOL has not been confirmed in these sources.

What to do now

  1. Do not assume the device is clean just because it still works. The backdoor is designed to run quietly and reinstall itself from the /oem/ partition after uninstall (BleepingComputer).
  2. Remove the device from the internet if you cannot be sure it is clean. Google says disconnecting it from the internet stops further malicious activity (BleepingComputer).
  3. Reflash with clean firmware or replace the device. Google says users need clean firmware to remove the malware (BleepingComputer), and recommends buying set-top boxes from reputable makers (Security Affairs).
  4. Keep Google Play Protect enabled and install apps only from trusted app stores (Security Affairs).
  5. Avoid “unused bandwidth” or proxy earning apps and review the permissions of any VPN or proxy apps on your devices (Security Affairs).
  6. If you are a retailer or distributor, require independent security audits and delist implicated manufacturers (Security Affairs).

Sources