Google disrupts XCPE botnet of 1.3M+ Android TV boxes backdoored in firmware by Videostrong, bans the maker from certified Android

Linha do tempo

1. malwarebytes.com ↗ · pub. 03/11/2026 11:11 · coletado 03/11 12:02

   Videostrong-Built XCPE Backdoor Turns 1.3 Million Certified Android TV Boxes into Criminal Proxy Botnet

   ler a análise desta fonte ocultar

   Google's Threat Intelligence Group (GTIG) has disclosed with high confidence that Android device maker Videostrong Technology built and operated a firmware-level backdoor called XCPE (also known as x.cpe or com.oemservice) on 1.3 million Google-certified Android TV boxes, then sold criminal affiliates access to the resulting botnet. The backdoor was injected after the device's first boot, allowing it to bypass Google's compatibility and security certification tests. Affiliates used the compromised devices as a residential proxy network, routed ad-fraud traffic through them, captured live screenshots, injected keystrokes, harvested account and device data, and opened reverse shells. Google and partners have taken legal action to disrupt the domains and servers used to control the botnet and have banned Videostrong and its affiliates from producing certified Android devices, but the backdoor itself remains embedded in infected firmware and is not removed by the takedown.

   Technical Details

   The XCPE backdoor runs with system-level privileges and persists from the device's /oem/ partition, automatically reinstalling itself after reboot even if uninstalled. It can disable Google Play Protect app verification, enabling silent installation of additional malicious modules, including further backdoors loaded by criminal affiliates. Because the backdoor was loaded post-certification, infected devices passed Google's security checks before being compromised.

   Remediation

   Uninstalling the malicious app does not remove the backdoor, which lives in the firmware itself. Users who suspect their TV box is affected should disconnect it from the network and contact the seller or manufacturer for clean firmware or a replacement. Google has not published a full list of affected models. General guidance includes buying from reputable manufacturers, avoiding "free TV" boxes or apps that pay for bandwidth sharing, keeping Play Protect enabled, using trusted app stores, and isolating IoT/TV devices on a separate network or VLAN with restricted outbound access.

2. infosecurity-magazine.com ↗ · pub. 03/11/2026 06:35 · coletado 03/11 08:01

   Google GTIG and partners disrupt XCPE Android botnet preinstalled by Videostrong on 1.3M+ set-top boxes

   ler a análise desta fonte ocultar

   Google Threat Intelligence Group (GTIG) reported on November 2 that it assessed with high confidence that Chinese Android ODM/OEM Videostrong Technology was responsible for the XCPE botnet and backdoor. The botnet contained more than 1.3 million set-top boxes. Google, working with partners, disrupted the C2 servers used by Videostrong's criminal affiliates to install over a dozen malware families, severing control of more than 10 million compromised devices. Google has cut ties with Videostrong and banned it from making devices with preloaded Google apps. Besides set-top boxes, the botnet included telehealth devices, karaoke machines and digital signage. Google warns the underlying illicit market is resilient and that operators will pivot to new loaders or rival monetization SDKs.

   Technical Details

   • The backdoor x.cpe was embedded in device firmware for several years across many models and brands, and ran at android.uid.system privilege level.
   • It reinstalls itself from the /oem/ partition on reboot if a user removes it.
   • On startup it contacts a C2 server and uses the MQTT message broker for commands. Affiliates can execute shell scripts, disable Google Play Protect and silently install additional apps.
   • Videostrong monetized access by selling it to criminal affiliates, who loaded modules for ad fraud, enrolled devices in residential proxy networks and installed further malware.
   • Proxy and monetization SDKs named include Linkfog, AppSalt/Honeygain, GaGaNode, NetNut and Traffmonetizer.
   • Google says the campaign was not an isolated rogue insider or development oversight.

   Remediation

   The article gives no user-level remediation. Google's response was the C2 disruption and the ban on Videostrong preloading Google apps. Google calls for accountability across the hardware supply chain, the residential proxy industry and the wider technology ecosystem.

3. securityaffairs.com ↗ · pub. 03/11/2026 06:52 · coletado 03/11 08:00

   Google dismantles XCPE backdoor botnet of 1.3M Android set-top boxes allegedly run by OEM Videostrong

   ler a análise desta fonte ocultar

   Google and its partners disrupted XCPE, a backdoor preloaded in firmware that enrolled more than 1.3 million Android TV set-top boxes and other devices into a botnet. Google assesses with high confidence that the OEM/ODM Videostrong Technology Co. deliberately built, spread and operated it for profit, selling access to criminal affiliates who loaded ad-fraud, residential proxy and other malware modules. Google banned Videostrong from making devices with pre-installed Google apps, took legal action against its command-and-control domains and servers and against the C2 domains of over a dozen affiliate malware families, and expects the takedown to cut access to at least 10 million more compromised devices. Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI supported the operation.

   Technical Details

   • Three-stage malware: the primary backdoor x.cpe (also com.oemservice) is preloaded in firmware, runs with system privileges and reinstalls itself from the /oem/ partition at the next reboot if uninstalled. It hands work to the loader com.abc.nexus, which has anti-analysis features and sets up the monetization modules.
   • Obfuscation and delayed loading of the malicious code after first boot let it evade Google's compatibility and security tests.
   • C2 works in two steps: an HTTP request downloads settings, location and network data, then a persistent MQTT connection receives commands. All analyzed samples used the same MQTT server. Operators managed infrastructure via remote interfaces and an EMQX web console.
   • Operator capabilities: silent app installation, command and script execution, screenshots, keystroke recording, network mapping, collection of account/device info, app lists and logs, remote shell sessions, and disabling Google Play Protect verification. Most activity was installing, removing and managing malware modules.
   • Payloads are mostly hosted as GitHub releases on operator-owned accounts, plus the Filemail service and two operator-controlled servers.
   • Modules: residential proxy and bandwidth-sharing kits (Linkfog, AppSalt, GaGaNode, BWM, Traffmonetizer, EarnFM, NetNut), with up to three proxy kits per device, and ad-fraud modules Fission and HiddenView (fake impressions, hidden browser windows simulating clicks and scrolling). AppSalt's SDK (owned by Honeygain) calls an opt-in function without a consent screen.
   • Devices are assigned to six timezone-based pools on ott.szbboys[.]com, with per-module resource limits and priority weights.
   • Affected devices are mostly Android TV boxes, but also telehealth devices, karaoke machines and digital signage, across multiple brands and models over several years.

   Remediation

   • Buy connected devices only from reputable manufacturers and check the partner list on Google's Android TV website; keep Google Play Protect enabled.
   • Avoid apps that pay for "unused bandwidth" or "sharing your internet", and review permissions of third-party VPN and proxy apps.
   • Retailers and distributors should require independent security audits of device makers and delist those implicated in supply-chain abuse; proxy providers should offer auditable proof of user consent.
   • Google has changed its review process and is improving firmware checks on certified Android TV devices.
4. gbhackers.com ↗ · pub. 03/11/2026 02:11 · coletado 03/11 04:00

   Google Dismantles XCPE Botnet: Videostrong Firmware Backdoor Infected 1.3M+ Android TV Devices

   ler a análise desta fonte ocultar

   Google Threat Intelligence Group (GTIG) and partners disrupted the XCPE botnet, a firmware-level backdoor preinstalled on more than 1.3 million Android set-top boxes. GTIG assesses with high confidence that Android OEM/ODM Videostrong Technology Co. deliberately built and operated it for profit, and sold access to criminal affiliates. Affiliate modules performed ad fraud, turned devices into residential proxy exit nodes and installed further malware. Google also disrupted C2 domains of more than a dozen affiliate malware families, expecting to cut access to at least 10 million additional compromised devices. It pursued legal action against Videostrong's domains and servers and banned Videostrong and any future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors. TrendAI counted 1,472,554 infected devices across 206 models between June 3 and October 1 (a lower bound), with the highest counts in Malaysia, Brazil, Iraq, Mexico and Taiwan.

   Technical Details

   • Modular design since at least late 2024. The primary backdoor x.cpe (sometimes com.oemservice) is preloaded in firmware, runs as android.uid.system and reinstalls from the /oem/ partition at reboot if removed.
   • Loader com.abc.nexus handles anti-analysis and module execution. Since August 2026 operators mass uninstalled it and pushed single-module droppers disguised as system apps such as com.android.system.ntp.
   • Monetization modules include proxy SDKs (Linkfog, AppSalt, NetNut, GaGaNode) and ad-fraud tools (CBOXTV, HiddenView). Some devices ran up to three proxy SDKs at once. The Popanet component matches malware from Google's earlier NetNut disruption.
   • Two-stage C2: an HTTP POST with AES-encrypted hardware telemetry retrieves configuration, then a persistent MQTT connection to the broker mqtt.szbboys[.]com. Operators can silently install apps, run shell commands, capture screens, inject keystrokes, map victim networks, open reverse shells and exfiltrate account data, package inventories and logs.
   • Defense evasion: Google Play Protect is disabled by setting package_verifier_user_consent to -1, and the loader drops libseccomp_guard.so to hinder sandboxing and instrumentation.
   • Some variants use libexploit.so to restart adbd with root, remount the system partition read-write and copy themselves into /system/priv-app/. The property persist.networkstack.uninstall lets operators manage cleanup.
   • Videostrong exploited a gap in Google's compatibility testing by loading malicious code after the initial boot. Google has since revised its review process and firmware integrity checks for certified Android TV devices.
   • Videostrong removed malicious modules from x.cpe in late 2024, possibly in response to enforcement against BADBOX.
   • Besides set-top boxes, the backdoor was found on telehealth devices, karaoke machines and digital signage.
   • Investigation partners: Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI.

   Remediation

   • Owners cannot remove the implant themselves; cleanup requires vendor action, platform protection or device replacement. Plume recommends a full factory reset because modules may have planted extra backdoors, but does not say a reset removes x.cpe.
   • Replace affected set-top boxes and avoid uncertified or off-brand Android TV hardware.
   • Isolate smart devices on a guest network or separate segment.
   • Block and monitor traffic to szbboys[.]com and anyevonline[.]com, and block broker IPs 219.134.163[.]210 and 219.134.163[.]211.
   • Watch for unexpected MQTT or proxy traffic from streaming devices.
5. krebsonsecurity.com ↗ · pub. 02/11/2026 23:24 · coletado 03/11 01:00

   Google and partners dismantle XCPE botnet of 1.3M pre-infected Android TV boxes used as residential proxies

   ler a análise desta fonte ocultar

   Google and industry partners took down the XCPE botnet, which comprised more than 1.3 million Android TV set-top boxes shipped with malware by Chinese manufacturer Videostrong Technology Co. The malware rented out users' Internet connections through residential proxy services and enabled advertising fraud. The Google Threat Intelligence Group (GTIG) says Videostrong sold access to criminal affiliates and loaded their malware modules onto the devices. Google took legal action against the domains and servers used for command and control. Experts expect the takedown to cut the botnet's access to at least 10 million additional compromised devices, and Synthient's founder calls the 1.3 million figure "highly conservative".

   Technical Details

   • Videostrong loaded its malicious software immediately after a user first booted one of the devices, getting around Google's Android compatibility and security tests. Google says it has since addressed that weakness.
   • Besides TV boxes, XCPE was found in telehealth devices, karaoke machines and digital signage.
   • The GTIG report calls out residential proxy providers whose SDKs were routinely downloaded by infected devices, including AppSalt/Honeygain (owned by Oxylabs, relaunched as Source). Other providers linked to the botnet or named in the report are NetNut, EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb and GaGaNode.
   • Synthient's report found that MECOOL boxes sold by Skyworth Technology also bundled Videostrong's malware and AppSalt/Honeygain and other proxy components. Synthient's founder also says the malware distributed Grass proxy software.
   • The article recalls related activity. In July 2026 the FBI seized domains associated with NetNut (operated by Alarum Technologies), saying it ran a separate botnet, Popa. In January 2026 Synthient documented how the Kimwolf botnet infected millions of Android set-top boxes.
   • Affiliates of Videostrong have distribution channels beyond XCPE, so some infected devices may remain.

   Remediation

   • The article gives no specific user guidance. Synthient published a list of affected devices by model number, and Plume Security Labs, Black Lotus Labs and TrendAI published analyses.
6. cyberscoop.com ↗ · pub. 02/11/2026 18:58 · coletado 02/11 19:00

   Google disrupts XCPE botnet pre-installed by Videostrong on 1.3M+ TV set-top boxes

   ler a análise desta fonte ocultar

   Google and partners disrupted XCPE, a botnet built from a backdoor that China-based Android OEM Videostrong Technology Co. deliberately pre-installed on more than 1.3 million TV set-top boxes. According to a Google Threat Intelligence Group (GTIG) report, cybercriminals used the infected devices for ad fraud, data exfiltration and routing malicious traffic through residential proxy networks. Google took legal action against the domains and servers Videostrong used for control, and also took down command-and-control domains of more than a dozen malware families that ran as modules through the XCPE backdoor. Google says this disrupted access to at least 10 million additional compromised devices from other manufacturers. It banned Videostrong and any future subsidiaries from building or selling certified Android devices, and said it changed its review process without disclosing details. The botnet spanned more than 170 countries, with the largest concentrations in Malaysia, Brazil, Iraq, Mexico and Taiwan, and nearly 44,000 infected devices in the United States between June and October (per TrendAI). The takedown is already completed and involves no CVE; the severity is rated medium for defenders, although the scale of the compromise (1.3 million devices, more than 170 countries) is large.

   Technical Details

   • Videostrong shipped devices with malware for years and evaded Google's security tests by loading the malicious code after the device's first boot.
   • The operators constantly evolved configurations to evade Google's pre- and post-launch detections, per GTIG's Charley Snyder.
   • Most infected devices were Android TV set-top boxes; infected Android-based telehealth devices, karaoke machines and digital signs were also observed.
   • Google assesses the campaign was not an isolated rogue insider or a development oversight.
   • Partners in the disruption: Japan's National Police Agency, Lumen Technologies, Human Security, Plume and Synthient. TrendAI researchers provided the geographic distribution.
   • Google warns the markets for backdoors, ad fraud and residential proxies are resilient and operate as an interconnected supply chain.

   Remediation

   • The article gives no user-facing guidance.
7. theregister.com ↗ · pub. 02/11/2026 16:03 · coletado 02/11 17:00

   Coalition disrupts XCPE Android backdoor botnet of 1.3M TV boxes preinstalled by Videostrong

   ler a análise desta fonte ocultar

   A coalition of Google, Lumen, Human Security, Plume, Synthient and TrendAI, working with Japan's National Police Agency, disrupted XCPE, a backdoor that formed a botnet of more than 1.3 million Android devices in over 200 countries. Google Threat Intelligence Group (GTIG) assesses with high confidence that Shenzhen-based hardware manufacturer Videostrong Technology deliberately developed, embedded and operated the backdoor for financial gain. Videostrong sold access to criminal affiliates, who installed additional malware modules on TV boxes and projectors shipped to unsuspecting customers. The coalition also took down affiliate C2 domains, which GTIG assesses will sever access to at least 10 million additional compromised devices. The operation belongs to the same ecosystem as BadBox 2.0, disrupted in March 2025.

   Technical Details

   • XCPE was embedded in device firmware. A preinstalled management agent posed as a standard remote-management client (TrendAI).
   • The agent pulled updates from a GitHub page and connected to an MQTT server, giving the operator full remote control: install and remove apps, change settings, push updates.
   • Infected devices were used as residential proxies to hide malicious traffic behind customers' home internet connections.
   • Between June 3 and October 1, TrendAI documented more than 3.8 million distinct home and mobile IP addresses tied to the operation.
   • Affiliates use diversified distribution channels for their modules beyond XCPE.

   Remediation

   • Google cut ties with Videostrong and banned the OEM from making devices with preloaded Google apps.
   • The article gives no user-side remediation steps. Defenders should treat Videostrong-built Android TV boxes and projectors as potentially compromised.
   • Videostrong did not respond to The Register's inquiries.
8. bleepingcomputer.com ↗ · pub. 02/11/2026 15:16 · coletado 02/11 17:00

   Google disrupts XCPE Android botnet of 1.3M TV boxes backdoored at the factory by Videostrong, bans the maker

   ler a análise desta fonte ocultar

   Google and partners dismantled the XCPE botnet, made up of more than 1.3 million Android TV boxes whose firmware was backdoored during manufacturing. Google's Threat Intelligence Group (GTIG) attributes it with high confidence to the Chinese manufacturer Videostrong Technology Co, which allegedly sold access to criminal affiliates for ad fraud, residential proxy services and further malware installation. The disruption also took down C2 servers used by more than a dozen related malware families, cutting off at least 10 million other compromised devices (set-top boxes, karaoke machines, telehealth hardware, not all of them Android). Google revoked Videostrong's license to build Android TV devices with Google apps and banned it and its future affiliates from producing certified Android devices. The malware remains on infected devices and reinstalls itself if removed.

   Technical Details

   • The main backdoor, tracked as x.cpe and com.oemservice, runs with Android system privileges and is embedded in firmware. It has a modular architecture that separates backdoor functions from revenue-generating modules.
   • At boot it contacts C2 on anyevonline[.]com (subdomains vary by Android version and device type) to get connection details and credentials for an MQTT broker (mqtt.szbboys[.]com), which is used to receive commands.
   • Capabilities: silent app installation, disabling Google Play Protect, shell commands and scripts with system privileges, screenshots, keystroke injection, collection of account, device, app and log data, network reconnaissance and reverse shells.
   • Modules monetized devices through residential proxy services (Linkfog, AppSalt/Honeygain, GaGaNode, NetNut, Traffmonetizer) and ad fraud (impressions, hidden pages, ad clicks). Some modules installed further backdoors: Moyu, Spirit and Bird.
   • In late 2024 Videostrong introduced the loader com.abc.nexus. Since August 2026 it has been replaced with smaller droppers disguised as Android system apps.
   • Synthient traced the backdoor to Videostrong from a MECOOL KM9PRO Max box bought in late 2025. It found an open directory on file.anyevonline[.]com containing backdoors and a PDF by Videostrong's R&D director. videostrong[.]cn resolved to the same IP as mqtt.anyevonline[.]com, and Videostrong email addresses were used to sign the backdoors.
   • Videostrong used obfuscation to evade Google's certification testing and loaded malicious code after first boot. Google has changed its certification review process.
   • Partners in the disruption: Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI.

   Remediation

   • The takedown did not clean infected devices: the malware reinstalls itself from the /oem/ partition if removed.
   • Install clean firmware on affected devices, or disconnect them from the internet to stop malicious activity.
9. helpnetsecurity.com ↗ · pub. 02/11/2026 12:50 · coletado 02/11 14:01

   Google disrupts XCPE Android TV botnet of 1.3M devices and bans Videostrong Technology

   ler a análise desta fonte ocultar

   Google disrupted XCPE, a backdoor embedded in the firmware of Android TV set-top boxes, and Google Threat Intelligence Group attributes the operation with high confidence to Videostrong Technology, the manufacturer of many of the boxes. More than 1.3 million devices were enrolled. The company sold access to criminal affiliates, who pushed their own modules for hidden ad fraud, residential proxy enrollment, theft of account details and logs, and further malware installation. Google estimates that taking down the affiliates' command domains cuts off at least 10 million more compromised devices that arrived through other routes and malware families. Google took legal action against the infrastructure and banned Videostrong and its future subsidiaries and affiliates from building certified Android devices.

   Technical Details

   • The main component runs with system privileges and reinstalls itself from a protected partition after reboot, so deleting the app does not clear the device.
   • It disables Google Play Protect by rewriting the package verification setting and wipes records of user consent.
   • Operators can take live screenshots, inject keystrokes and open a shell on the device.
   • Since August 2026, operators have installed droppers disguised as system packages that use a privilege escalation exploit to write to the system partition, making removal harder.
   • Besides set-top boxes, other infected Android-based IoT devices include telehealth devices, karaoke machines and digital signage.
   • Affiliate modules were used for hidden ad views, residential proxy networks, credential and log theft, and delivery of more than a dozen malware families.

   Remediation

   • Google took legal action against the tasking and module delivery domains and servers, and against the command infrastructure of more than a dozen malware families.
   • Google tightened firmware integrity checks for certified Android TV devices and changed its manufacturer review process to close the testing gap that was abused.
   • Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI contributed to the takedown.
   • Because deleting the app does not remove the implant, owners of affected boxes cannot rely on uninstalling it.
10. thehackernews.com ↗ · pub. 02/11/2026 12:50 · coletado 02/11 14:00 primeiro registro

    Google disrupts 1.3M-device Android botnet and blames TV box maker Videostrong for x.cpe firmware backdoor

    ler a análise desta fonte ocultar

    Google led a takedown in late October 2026 of a botnet of more than 1.3 million Android devices, mostly TV set-top boxes. Google says it is highly confident that Shenzhen-based maker Videostrong intentionally built the x.cpe backdoor into its firmware and sold access to criminals. The operators used the boxes for ad fraud and as residential proxies. Google used legal action to take down the botnet's C2 domains and servers, plus the control domains of more than a dozen malware families loaded through the backdoor, and banned Videostrong from building or selling certified Android devices. The backdoor remains on devices in the field, and owners cannot remove it themselves.

    Technical Details

    • x.cpe runs as a system app inside the firmware, signed with the maker's key and with system-level access. It reports to C2 servers and waits for orders. To install software silently, it first disables app checks in Google Play Protect.
    • Capabilities: silent app installation, command execution, screen capture and network mapping. Google observed live screenshots, keystroke injection, theft of account details, device information, app lists and system logs, and reverse shells.
    • Most modules turned the boxes into residential proxies or sold their bandwidth. Others faked online ad views.
    • Because x.cpe is part of the firmware, it reinstalls itself on restart, so removal does not persist.
    • Attribution to Videostrong rests on several points:
      • x.cpe passes C2 settings to other Videostrong apps, including the YokaTV Player streaming app.
      • A GitHub account hosting botnet packages is named yf-videostrong.
      • Synthient found a document signed by Videostrong's R&D director in an open folder on a botnet server.
      • A Videostrong web domain shares an IP address with the operators' control panel.
      • Plume found that Videostrong supplies both the firmware and the remote management tools.
    • Google says Videostrong hid its code to bypass a gap in its compatibility and security tests and loaded the malicious code after first boot. Google has changed its review process.
    • TrendAI (Trend Micro) counted 1,472,554 infected devices across 206 models between June 3 and October 1, with the most in Malaysia, Brazil, Iraq, Mexico and Taiwan. The US, Germany, UK, Australia and Canada each had about 26,000 to 42,000.
    • Synthient published a list of 182 device model names (a model name alone does not confirm infection). Its report focuses on MECOOL-branded boxes, and a purchased MECOOL KM9PRO Max had the backdoor preinstalled.
    • Plume found more than a dozen devices, mostly MECOOL, using the C2 server. It reports that both Google-certified and AOSP devices were affected.
    • Besides TV boxes, the backdoor also appeared on telehealth devices, karaoke machines and digital signage.
    • Google expects the action to cut off access to at least 10 million more infected devices, but warns that operators switch tools quickly.
    • Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI assisted in the operation.

    Remediation

    • Plume recommends a full factory reset, but does not say whether it removes x.cpe itself. Synthient advises discarding affected boxes.
    • Organizations should use Synthient's published indicators to find MECOOL or similar devices, disconnect and discard any found, and block the listed C2 domains and IPs.
    • Keep smart devices on separate network segments away from sensitive systems.
    • TrendAI advises treating unmanaged consumer devices on remote staff's home networks as part of the attack surface and keeping corporate access behind managed devices.
    • TrendAI says cleanup needs vendor action, platform protection or device replacement.

Repetiram sem novidade

• securityweek.com — Google dismantles XCPE botnet of 1.3 million backdoored Android set-top boxes run by OEM Videostrong