Google disrupts XCPE botnet and bans Videostrong

Google said it and its partners had broken up XCPE, which it described as a botnet spanning more than 1.3 million Android TV streaming boxes. It said the operation was linked with high confidence to Videostrong Technology Co, which it accused of planting the backdoor in devices it manufactured and selling access to criminal affiliates.

According to Google, those affiliates used the infected boxes for ad fraud, residential proxy services and delivery of further malware. The company also said it cut off command servers connected to more than a dozen associated malware families, affecting at least 10 million additional compromised devices, some of which were not Android boxes.

Google said the backdoor had been built into firmware during manufacturing and that the main components, tracked as x.cpe and com.oemservice, ran with system privileges. It said infected devices contacted anyevonline[.]com for connection details before using an MQTT broker to receive commands.

Google said the malware could install apps, disable Play Protect, run shell commands, take screenshots, record keystrokes and collect device information. It said the operators later used com.abc.nexus as a loader and, from August 2026, began switching to smaller droppers disguised as Android system applications.

Synthient said it tied the campaign to Videostrong after buying a MECOOL KM9PRO Max Android TV box in late 2025 and finding the malware already present. It said it found an open directory on the operators' server, a shared IP address with Videostrong's domain and company email addresses used on the backdoors; Google said it had changed its certification review process and that the malware could reinstall itself from the /oem/ partition.