Google says it and industry partners have dismantled the XCPE botnet, which the company says infected more than 1.3 million Android TV streaming boxes, and has ended its relationship with Videostrong and revoked its licence to manufacture Android TV devices with preloaded Google apps and services. In a report published Monday, Google's Threat Intelligence Group said it attributes the botnet with high confidence to Chinese device maker Videostrong Technology Co, which it accuses of deliberately installing a persistent backdoor and selling access to criminal affiliates.
Google says the takedown also struck command-and-control servers used by more than a dozen related malware families, cutting off access to at least 10 million additional compromised devices. Those devices, which Google says were infected by other means, include retail set-top boxes, karaoke machines and telehealth hardware, and not all of them run Android.
Google says the campaign differed from botnets that spread by exploiting vulnerabilities or tricking users into installing software: the malicious code was embedded directly into device firmware during manufacturing. The company says Videostrong developed and distributed it across multiple device brands and models over several years, with dedicated infrastructure and evolving configurations.
According to Google, the main backdoor components, tracked as x.cpe and com.oemservice, ran with Android system-level privileges. On startup an infected device contacted a server on the anyevonline domain for credentials to an MQTT message broker used to receive commands, which allowed operators to silently install apps, disable Google Play Protect, run shell commands and scripts, capture screenshots and inject keystrokes, collect account and device information, and establish reverse shells. Google says affiliates also used the devices to route third-party internet traffic as residential proxies, through services it named as Linkfog, AppSalt/Honeygain, GaGaNode, NetNut and Traffmonetizer, and to commit ad fraud by generating impressions and clicking advertisements.
In a separate report, security firm Synthient said it traced the backdoor to Videostrong after finding the malware preinstalled on a MECOOL KM9PRO Max Android TV box bought in late 2025. Synthient said it found a publicly accessible directory on the malware's file server hosting backdoors used by the operators, which included a folder holding a PDF by Owen Cao, Videostrong's R&D director. It said Videostrong's own domain pointed to the same IP address as the command-and-control server, and that numerous Videostrong company email addresses had been used to sign the backdoors.
Google said the evidence indicated deliberate installation rather than a rogue employee or a development oversight. "We believe this campaign wasn't an isolated rogue insider or a development oversight," the company said. Its Threat Intelligence Group wrote in the report: "We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co."
Google says it has terminated its relationship with Videostrong, revoked its licence to manufacture Android TV devices with preloaded Google apps and services, and banned the company and its future affiliates from producing certified Android devices or supplying software to certified vendors. It says it has also modified its certification review process after finding that Videostrong used obfuscation to evade security testing and loaded malicious code after devices first booted.
Japan's National Police Agency and the security companies Lumen, HUMAN Security, Plume, Synthient and TrendAI took part in the disruption, according to Google. The company says the malware has not been removed from infected devices and will reinstall itself from the /oem/ partition if deleted, so owners would need to install clean firmware to remove the infection or disconnect the device from the internet to prevent further malicious activity.
Analysis
Why This Matters
- The botnet was built into hardware before sale, so ordinary security advice about avoiding suspicious downloads would not have protected owners of affected streaming boxes.
- Google's action reaches beyond the 1.3 million XCPE devices: it says the server takedown cut off access to at least 10 million more compromised devices, including karaoke machines and telehealth hardware.
- Infected devices remain compromised after the disruption, meaning owners of affected boxes still face a decision about firmware or disconnection.
Background
Botnets are networks of compromised internet-connected devices controlled remotely, and consumer electronics with weak update paths have long been a favoured target because they are cheap, always online and rarely inspected by their owners. Google certifies manufacturers that wish to ship Android TV devices with its apps and services, and can withdraw that certification. Supply-chain compromises, where malicious code ships inside a product rather than arriving later, are harder for buyers to detect and for platforms to remove.
Key Perspectives
Google Threat Intelligence Group: says it assesses with high confidence that the backdoor and botnet were intentionally developed, deployed and operated for financial gain by Videostrong Technology Co, and that the campaign was not a rogue insider or a development oversight.
Synthient: says it traced the malware and infrastructure to Videostrong after finding the backdoor preinstalled on a retail Android TV box, citing a shared server address and company email addresses used to sign the backdoors.
What to Watch
- Whether owners of affected streaming boxes replace their firmware or take devices offline, since Google says the malware reinstalls itself if simply deleted.
- How Google's modified certification review process changes testing for devices that load code after first boot.
- Whether the takedown of the shared command-and-control servers measurably reduces activity across the dozen related malware families Google names.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedGoogle said, “We believe this campaign wasn't an isolated rogue insider or a development oversight.”BleepingComputer: “"We believe this campaign wasn't an isolated rogue insider or a development oversight," Google said.”
- SupportedGoogle’s Threat Intelligence Group said it assessed with high confidence that Videostrong intentionally developed, deployed and operated the backdoor and botnet for financial gain.BleepingComputer: “"We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.," Google's Threat Intelligence Group (GTIG) said”
- SupportedGoogle and industry partners dismantled the XCPE botnet, which involved more than 1.3 million Android TV streaming boxes.BleepingComputer: “Google and industry partners have dismantled the XCPE malware botnet consisting of more than 1.3 million Android TV streaming TV boxes”
- SupportedGoogle revoked Videostrong’s licence to manufacture Android TV devices with preloaded Google apps and services.BleepingComputer: “Google has also terminated its relationship with Videostrong, revoked its license to manufacture Android TV devices with preloaded Google apps and services”
- SupportedGoogle attributes the botnet with high confidence to Chinese device manufacturer Videostrong Technology Co.BleepingComputer: “The company attributes the botnet with high confidence to Chinese device manufacturer Videostrong Technology Co”
- SupportedGoogle accused Videostrong of deliberately installing a persistent backdoor and selling access to criminal affiliates.BleepingComputer: “accusing the company of deliberately installing a persistent backdoor into devices it manufactured and selling access to criminal affiliates.”
- SupportedThe takedown cut off access to at least 10 million additional compromised devices.BleepingComputer: “cutting off access to at least 10 million additional compromised devices.”
- SupportedThe additional devices were compromised through means other than XCPE, and not all were Android devices.BleepingComputer: “These additional devices were compromised through malware distributed through other means than XCPE, and include retail set-top boxes, karaoke machines, and telehealth hardware. Google says that not all of them are Android devices.”
- SupportedThe XCPE malware was embedded directly into device firmware during manufacturing.BleepingComputer: “the XCPE botnet was embedded directly into device firmware during manufacturing.”
- SupportedSynthient said it found the backdoor preinstalled on a MECOOL KM9PRO Max Android TV box it bought in late 2025.BleepingComputer: “Synthient explains how it traced the XCPE backdoor and infrastructure to Videostrong after discovering the malware preinstalled on a MECOOL KM9PRO Max Android TV box purchased in late 2025.”
- SupportedSynthient said Videostrong’s domain pointed to the same IP address as the command-and-control server, and company email addresses had been used to sign the backdoors.BleepingComputer: “Videostrong's videostrong[.]cn domain pointed to the same IP address as mqtt.anyevonline[.]com, the command-and-control server”
- SupportedGoogle says the malware remains on infected devices and will reinstall from the /oem/ partition if deleted.BleepingComputer: “the malware has not been removed from in infected devices and will automatically reinstalls itself from the /oem/ partition if removed.”
