Google disrupts million-device XCPE Android malware botnet, bans TV box maker

Google and a group of industry partners have dismantled the XCPE malware botnet, made up of more than 1.3 million Android TV streaming boxes that the company says its manufacturer intentionally infected with malware to generate revenue through cybercrime. Google attributes the botnet with high confidence to Chinese device manufacturer Videostrong Technology Co., accusing the company of deliberately installing a persistent backdoor into devices it built and selling access to criminal affiliates. Those affiliates used the backdoored devices to deploy malicious modules for ad fraud, turned infected devices into residential proxies, and installed additional malware. "We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.," Google's Threat Intelligence Group said in a report published Monday. As part of the disruption, Google took down XCPE command-and-control servers used by more than a dozen related malware families, cutting off access to at least 10 million additional compromised devices. These additional devices, compromised through malware distributed by other means, include retail set-top boxes, karaoke machines, and telehealth hardware, and not all of them are Android devices. Google has also terminated its relationship with Videostrong, revoked its license to manufacture Android TV devices with preloaded Google apps and services, and banned the company and its future affiliates from producing certified Android devices or supplying software to certified vendors. The company says it has modified its certification review process after discovering that Videostrong used obfuscation techniques to evade security testing and loaded malicious code after devices first booted. Unlike botnets that typically breach devices through vulnerabilities or by tricking users into installing malware, XCPE was embedded directly into device firmware during manufacturing. Google says Videostrong had been developing and distributing the malware across multiple device brands and models for years, evolving its capabilities to evade detection and support different criminal affiliates. "We found this malicious software built directly into many different device models and brands over multiple years, supported by dedicated infrastructure and constantly evolving configurations to evade detection and manage their affiliates," Google said. The main backdoor components, tracked as x.cpe and com.oemservice, run with Android system-level privileges. The malware uses a modular architecture that separates backdoor functions from revenue-generating modules. After an infected device starts, XCPE contacts a command-and-control server on the anyevonline.com domain to obtain connection information and credentials for an MQTT message broker, hosted at mqtt.szbboys.com, which was used to receive commands and deploy other malware to infected devices. Google says the malware uses different subdomains of anyevonline.com depending on the Android version and device type. The infected devices functioned as a plug-in cybercrime platform. Google says the modules included software associated with residential proxy services such as Linkfog, AppSalt/Honeygain, GaGaNode, NetNut, and Traffmonetizer, which routed third-party internet traffic through the devices without their owners' knowledge or consent. Other modules committed ad fraud by generating ad impressions, loading hidden webpages, and clicking advertisements, while some installed additional backdoors including Moyu, Spirit, and Bird to download and execute other malware. The operators continuously changed the malware's architecture to avoid detection. In late 2024, Videostrong began using a separate loader called com.abc.nexus, which ran the malicious modules while XCPE focused on communications with the command-and-control infrastructure. Since August 2026, the operators began replacing that loader with smaller, specialized droppers disguised as Android system applications. In a separate coordinated report, cybersecurity firm Synthient explained how it traced the XCPE backdoor and infrastructure to Videostrong after discovering the malware preinstalled on a MECOOL KM9PRO Max Android TV box purchased in late 2025. Researchers found a publicly accessible directory on the malware's file.anyevonline.com server hosting the backdoors, along with a PDF authored by Owen Cao, the R&D director of Videostrong Technology Co. The firm also found that Videostrong's videostrong.cn domain pointed to the same IP address as mqtt.anyevonline.com, the server operators used to list compromised devices, push commands, and manage application installs, and that numerous Videostrong company email addresses had been used to sign the backdoors. "We believe this campaign wasn't an isolated rogue insider or a development oversight," Google said. The disruption involved Japan's National Police Agency and security companies Lumen, HUMAN Security, Plume, Synthient, and TrendAI, which coordinated to analyze the malicious infrastructure and disrupt its operations. Google says the takedown has disrupted XCPE's operations, but the malware has not been removed from infected devices and will automatically reinstall itself from the /oem/ partition if deleted. Users would need to install clean firmware to remove the infection, or disconnect affected devices from the internet to prevent further malicious activity.