Firmware-level botnet hits 1.3M TV boxes

A botnet of more than 1.3 million Android TV streaming boxes has been dismantled, and the company Google blames for it isn't an outside attacker — it's the manufacturer. According to Google, Videostrong Technology Co. built the malware into devices at the factory, then sold access to criminal affiliates who used the infected hardware for ad fraud, residential proxying, and further malware delivery.

The disruption, carried out with industry and law enforcement partners, also cut off command-and-control servers tied to more than a dozen related malware families, severing access to at least 10 million additional compromised devices, Google said. The company's Threat Intelligence Group published its findings in a report on Monday.

Malware shipped from the factory floor

The XCPE botnet did not spread the way most botnets do. It wasn't planted by exploiting a vulnerability or by tricking a user into sideloading an app. Google said the backdoor was embedded directly into device firmware during manufacturing, meaning buyers received already-compromised hardware.

Google attributes the operation with high confidence to Chinese device manufacturer Videostrong, accusing the company of deliberately installing a persistent backdoor and selling access to criminal affiliates. The company said Videostrong had been developing and distributing the malware across multiple device brands and models for years, evolving its capabilities to evade detection and support different criminal affiliates.

"We found this malicious software built directly into many different device models and brands over multiple years, supported by dedicated infrastructure and constantly evolving configurations to evade detection and manage their affiliates," Google says.

A two-part backdoor with a business model

The main backdoor component, tracked as x.cpe and com.oemservice, runs with Android system-level privileges. Google describes a modular architecture that separates the backdoor's core functions from the pieces designed to generate revenue for affiliates — effectively a plug-in cybercrime platform.

When an infected device boots, XCPE contacts a command-and-control server on the anyevonline[.]com domain to obtain connection information and credentials for an MQTT message broker. Google says the malware uses different subdomains of anyevonline[.]com depending on the Android version and device type. That broker, hosted at mqtt.szbboys[.]com, let operators send commands and deploy additional malware to infected devices.

Through that connection, operators could remotely control compromised devices and carry out actions including silently downloading and installing additional Android applications, disabling Google Play Protect, executing shell commands and scripts with system privileges, capturing screenshots, injecting keystrokes, collecting account information, device details, installed application lists and system logs, and conducting network reconnaissance and establishing reverse shells.

Proxies, ad fraud, and borrowed backdoors

Beyond remote control, the devices were used to generate revenue by installing malware modules belonging to other operators. Google said these modules included software associated with residential proxy services such as Linkfog, AppSalt/Honeygain, GaGaNode, NetNut, and Traffmonetizer, which routed third-party internet traffic through infected devices without their owners' knowledge or consent.

Other modules committed ad fraud by generating ad impressions, loading hidden webpages, and clicking advertisements. Some installed additional backdoors — including Moyu, Spirit, and Bird — to download and execute further malware.

Google says the botnet operators continuously changed the malware's architecture to avoid detection. In late 2024, Videostrong began using a separate loader called com.abc.nexus, which ran the malicious modules while XCPE focused on communications with the C2 infrastructure. Since August 2026, the operators began replacing that loader with smaller, specialized droppers disguised as Android system applications.

Tracing the trail back to the vendor

A separate coordinated report from cybersecurity firm Synthient explains how researchers traced the XCPE backdoor and its infrastructure to Videostrong. The firm's investigation began after it discovered the malware preinstalled on a MECOOL KM9PRO Max Android TV box purchased in late 2025.

Synthient found a publicly accessible directory on the malware's file.anyevonline[.]com server that hosted backdoors used by the operators. The open directory also included a PDF folder containing a PDF by Owen Cao, the R&D director of Videostrong Technology Co. Researchers further found that Videostrong's videostrong[.]cn domain pointed to the same IP address as mqtt.anyevonline[.]com, the command-and-control server used to list compromised devices, push out commands, and manage application installations. Numerous Videostrong company email addresses had also been used to sign the backdoors.

Google's verdict and the 10 million more

The evidence, according to Google, points to deliberate installation rather than a rogue employee or a development oversight.

"We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co."

— Google's Threat Intelligence Group (GTIG)

Google said its disruption took down XCPE command-and-control servers used by more than a dozen related malware families, cutting off access to at least 10 million additional compromised devices. Those devices were compromised through means other than XCPE and include retail set-top boxes, karaoke machines, and telehealth hardware. Google says not all of them are Android devices.

The scope of the takedown, in figures Google supplied:

• 1.3 million Android TV streaming boxes in the XCPE botnet
• 10 million additional compromised devices cut off from C2 access
• More than a dozen related malware families affected
• A separate loader, com.abc.nexus, in use since late 2024
• Smaller specialized droppers replacing that loader since August 2026
• One MECOOL KM9PRO Max unit purchased in late 2025 that led researchers to the operation

License revoked, certification tightened

Google has terminated its relationship with Videostrong, revoked its license to manufacture Android TV devices with preloaded Google apps and services, and banned the company and its future affiliates from producing certified Android devices or supplying software to certified vendors.

The company also said it has modified its certification review process after discovering that Videostrong used obfuscation techniques to evade security testing and load malicious code after devices first booted.

The disruption involved Japan's National Police Agency and security companies Lumen, HUMAN Security, Plume, Synthient, and TrendAI, which coordinated to analyze the malicious infrastructure and disrupt its operations.

The infection outlasts the takedown

Google says the takedown has disrupted XCPE's operations, but the malware has not been removed from infected devices. It will automatically reinstall itself from the /oem/ partition if removed. That means owners of affected hardware would need to install clean firmware to eliminate the infection, or disconnect the device from the internet to prevent further malicious activity.

The persistence mechanism is a direct consequence of how the malware was delivered: firmware-level code sits below the layer where ordinary app removal, factory resets, or store-based security tools typically operate.

Why this matters beyond one vendor

For anyone running a cheap streaming box, the practical takeaway is uncomfortable. The device may have arrived compromised, and the standard advice — uninstall the app, reset the box, run a scan — may not be enough, because the infection lives in the partition the system restores from. Google's own guidance points to clean firmware or disconnection as the only reliable fixes, which for many owners may effectively mean replacing the hardware.

For the broader device ecosystem, the case suggests that supply-chain trust can't be assumed at the point of sale, even for products carrying certified Google apps and services. Google's decision to revoke Videostrong's license and tighten its certification review indicates the company is treating manufacturer-level malware as a certification failure, not just a security incident. Whether that changes how other budget Android device makers are vetted is not yet clear, but the mechanism Google described — obfuscation to pass testing, with malicious code loading only after first boot — is one that any certification regime would struggle to catch at the factory gate.