Videostrong monetized the backdoor by selling access to criminal affiliates and loading those affiliates’ malware modules onto infected devices,
Google’s Threat Intelligence Group concluded in its report. Google announced this week that it dismantled the XCPE botnet with industry partners and Japanese police. The network held more than 1.3 million Android devices, mostly TV set-top boxes, that secretly rented out their owners’ internet connections and ran advertising fraud.
The backdoor, identified as XCPE or x.cpe, was built into multiple device models and brands manufactured over several years by Videostrong Technology, a Shenzhen-based company according to the Google Threat Intelligence Group. It runs as a system app inside the device’s firmware with system-level privileges. Some builds hide under the name com.oemservice.
Since August 2026, newer versions have disguised themselves as Android system apps such as com.android.system.ntp.
A backdoor in the firmware, not an app
Because x.cpe sits in the firmware, uninstalling it does not stick: it reinstalls itself from the device’s /oem/ partition every time the box restarts. Once active, it beacons to command-and-control servers and waits for orders.
Criminals used the infected boxes to route strangers’ internet traffic through owners’ home connections as residential proxies. They generated fake ad views and clicks, took live screenshots, sent keystrokes, copied account details and opened reverse shells — remote command lines into the device. Google found as many as three residential proxy SDKs running on a single box.
While TV boxes made up the overwhelming majority of the botnet, the same malware was also found on telehealth devices, karaoke machines and digital signage systems, Google said.
Google cuts ties with Videostrong
Google banned Videostrong and any future subsidiaries or affiliates from manufacturing certified Android devices. The ban also covers supplying software to other certified manufacturers. Google said it has changed its review process to improve checks on firmware integrity in certified Android TV devices.
🚨 GOOGLE DISMANTLES XCPE BACKDOOR: 1.3M+ ANDROID TV BOXES PRE-INFECTED AT THE FACTORY Google and partners took down the XCPE botnet last week. Google says, with high confidence, that Shenzhen device maker Videostrong built the "x.cpe" backdoor into its firmware on purpose and… pic.twitter.com/MA61Vd8vGe
The company also took legal action to take down the domains Videostrong used to control the botnet. As of November 2, Videostrong’s own website still listed products it calls Google Certified Android TV Box
and Google Certified Android TV Stick.
Plume, the Wi-Fi software firm that helped investigate, said the botnet included both Google-certified devices and devices running the Android Open Source Project version.
Synthient, one of the security firms that partnered with Google, purchased a MECOOL KM9PRO Max in late 2025 and discovered the backdoor pre-installed under the name com.oemservice.
The firm has published a list of more than 180 device models linked to the campaign, including the KM9PRO.
The takedown reached beyond the 1.3 million boxes
Japan’s National Police Agency worked with Google alongside Lumen, HUMAN Security, Plume, Synthient and TrendAI to disrupt the domains underpinning the botnet. Google said the action severed the command-and-control infrastructure. It may also have cut criminal access to at least 10 million additional compromised devices infected through other malware families. Charley Snyder, head of disruption operations at Google Threat Intelligence Group, told Recorded Future News that severing the domains the botnet communicated with was effectively rendering the malware benign.
Not the first pre-installed botnet
During 2025, Google’s probe into the BADBOX 2.0 botnet uncovered more than 10 million compromised devices, spanning smart TVs, streaming devices and projectors. In 2024, researchers found the Vo1d backdoor on nearly 1.3 million Android TV boxes across 197 countries. In 2026, the FBI seized hundreds of domains tied to NetNut, which operated a separate botnet called Popa that enslaved TV boxes as residential proxies.
Synthient founder Ben Brundage told KrebsOnSecurity that Videostrong’s malware also distributed software for the residential proxy service Grass — the same software a Censys researcher found bundled with the popular Superbox TV streaming device in a November 2025 investigation.
The malware is still on the devices
The takedown cuts the boxes’ current connection to malicious servers. It does not remove the backdoor from infected firmware, and the boxes can potentially be exploited by other criminals.
Plume recommends a full factory reset. Synthient urges owners to remove the devices from their networks entirely, change their Wi-Fi passwords and update router firmware. Google found the backdoor can even switch off Play Protect’s app verification, so the usual Android safety net may not help. TrendAI says cleanup needs vendor action, platform protection or replacement of the device.
Google Disrupts 1.3 Million-Device Android TV Botnet, Exposing Firmware Security Risks Google has disrupted a botnet involving more than 1.3 million Android set-top boxes, exposing a security risk that goes beyond malicious apps: a backdoor embedded in device firmware. Google's… pic.twitter.com/CTCAGq9F66
Earlier coverage: Google patches Android security flaw causing crash loops
