Overview

Google and its industry partners have disrupted the XCPE malware botnet, a large-scale operation involving more than 1.3 million Android TV streaming boxes and set-top devices. The malware was embedded directly into device firmware, allowing attackers to maintain remote access without requiring users to download or install malicious applications.

The operation has been attributed with high confidence to Chinese device manufacturer Videostrong Technology Co. The compromised devices were allegedly monetized by providing cybercriminal affiliates with access to run ad fraud operations, route internet traffic through residential proxy networks, and install additional malware.

As part of the disruption, Google also targeted command-and-control infrastructure connected to more than a dozen other malware families. The action is expected to cut off access to at least 10 million additional compromised devices, including set-top boxes, karaoke machines, and telehealth hardware.

Key Facts of the Incident

The investigation identified a supply-chain compromise in which malware was incorporated into devices before reaching consumers. Google coordinated with law enforcement and multiple cybersecurity companies to disrupt the infrastructure supporting the operation.

What Happened

The XCPE botnet operated differently from conventional malware campaigns that depend on phishing links, malicious downloads, or software vulnerabilities to infect devices.

Instead, the backdoor was embedded directly into device firmware during manufacturing. This allowed the malware to operate with elevated Android system privileges and remain active even after users purchased and configured their devices.

The infection process involved several stages:

1. Preinstalled Backdoor: The malicious component, identified as x.cpe or com.oemservice, was included in the device firmware and loaded with system-level privileges.

2. Connection to Command-and-Control Servers: Once the device started, the malware contacted remote infrastructure associated with the anyevonline[.]com domain to retrieve configuration information and connection credentials.

3. Remote Command Execution: The malware established communication with an MQTT message broker, allowing operators to remotely send instructions, download applications, execute commands, and manage infected devices.

4. Deployment of Additional Malware: Operators used the backdoor to install secondary malicious modules that supported advertising fraud, residential proxy services, and additional malware operations.

Because the malicious component was built into the firmware, users were generally unaware that their devices were compromised. The operation also evolved over several years, with changes designed to make the malware harder to detect and remove.

How the XCPE Malware Operated

The XCPE malware used a modular architecture that separated its core backdoor functionality from the additional components responsible for generating revenue.

The primary backdoor maintained communication with the attackers' infrastructure, while secondary modules performed different malicious activities.

1. Remote Device Control

The backdoor operated with Android system-level privileges, giving attackers extensive control over compromised devices.

Its capabilities included:

• Silently downloading and installing additional Android applications.

• Disabling Google Play Protect.

• Executing shell commands and scripts with elevated privileges.

• Capturing screenshots and injecting keystrokes.

• Collecting device information, account details, installed application lists, and system logs.

• Performing network reconnaissance and establishing reverse shell connections.

These capabilities allowed operators to use infected devices for activities extending well beyond ordinary advertising fraud.

2. Residential Proxy Network Abuse

One of the major revenue-generating activities involved enrolling compromised devices into residential proxy networks.

Through these modules, attackers could route third-party internet traffic through the victims' home internet connections without their knowledge or consent.

The investigation identified connections to proxy and bandwidth-sharing services, including Linkfog, AppSalt/Honeygain, GaGaNode, NetNut, and Traffmonetizer.

This type of abuse allows cybercriminals to disguise the origin of their internet traffic by making it appear to originate from legitimate residential IP addresses.

3. Advertising Fraud and Additional Malware

The infected devices were also used to conduct advertising fraud.

Malicious modules generated fraudulent ad impressions, loaded hidden webpages, and automatically interacted with advertisements to generate revenue.

Some components went further by installing additional backdoors, including malware families such as Moyu, Spirit, and Bird. This effectively transformed the XCPE backdoor into a distribution platform that could provide multiple criminal operators with access to compromised devices.

The malware architecture also evolved. A separate loader called com.abc.nexus was introduced in late 2024 to manage secondary payloads. From August 2026, operators began replacing this component with smaller, specialized droppers disguised as Android system applications.

Videostrong Attribution and Investigation

The operation was attributed with high confidence to Videostrong Technology Co., a Chinese manufacturer involved in producing Android-based consumer devices.

The investigation gained significant evidence after cybersecurity researchers examined a MECOOL KM9PRO Max Android TV box purchased in late 2025. The device was found to contain the com.oemservice backdoor, which provided attackers with persistent access and the ability to deploy additional payloads.

Researchers also identified connections between the malware infrastructure and Videostrong's domain, along with company-related documents and email addresses associated with signing the backdoors.

Google assessed that the campaign was not simply the result of an isolated rogue employee or an accidental software development issue. It concluded with high confidence that the backdoor and botnet had been deliberately developed and operated for financial gain.

Google's Response and Botnet Disruption

Google worked with Japan's National Police Agency and cybersecurity companies including Lumen, HUMAN Security, Plume, Synthient, and TrendAI to investigate and disrupt the malware infrastructure.

The coordinated operation involved several major actions:

• Command-and-Control Disruption: Legal action was taken to dismantle domains and servers used to control the XCPE botnet and distribute malicious modules.

• Affiliate Infrastructure Takedown: Additional command-and-control domains associated with more than a dozen malware families were targeted, potentially cutting off access to at least 10 million other compromised devices.

• Manufacturer Ban: Google terminated its relationship with Videostrong and banned the company, along with its future subsidiaries and affiliates, from manufacturing certified Android devices or supplying software to certified vendors.

• Security Review Improvements: Google introduced changes to its device certification and firmware review processes to prevent manufacturers from exploiting security-testing gaps to load malicious code after a device's first boot.

Although the operation disrupted the botnet's infrastructure, the takedown does not automatically remove the malware from devices that were already infected.

Immediate Impact & Risks

The XCPE operation highlights several significant security risks associated with compromised consumer electronics and connected devices.

• Unauthorized Device Access: Attackers could remotely control devices and execute commands with system-level privileges.

• Privacy Exposure: Compromised devices could collect account information, device details, application inventories, system logs, and screenshots.

• Residential IP Abuse: Victims' internet connections could be used to route traffic for unknown third parties, potentially associating their IP addresses with suspicious online activity.

• Persistent Malware Infection: The backdoor was stored in firmware and could reinstall itself after removal from the application directory.

• Expanded Attack Surface: Secondary malware modules allowed attackers to use infected devices as entry points for additional malicious activities.

A particularly concerning aspect is that removing the visible malicious application may not eliminate the infection. The backdoor can reinstall itself from the device's /oem/ partition after a reboot.

What Users and Organizations Should Do

Security teams and consumers should take steps to identify potentially affected devices and limit the risks associated with compromised IoT hardware.

1. Identify and Disconnect Suspicious Devices

Review connected Android TV boxes, streaming devices, and other IoT hardware. Organizations should investigate devices against available indicators of compromise and immediately disconnect suspected affected devices from their networks.

2. Replace or Reinstall Trusted Firmware

A standard application removal or factory reset may not eliminate a firmware-level backdoor. Where a confirmed affected device cannot be restored using trusted, verified firmware, replacing the device is the safer option.

3. Monitor Network Traffic

Organizations should monitor unusual outbound connections and investigate suspicious traffic originating from smart TVs, set-top boxes, and other connected devices. Known malicious command-and-control domains and indicators should be added to security monitoring and blocking systems.

4. Isolate IoT Devices

Connected devices should operate on dedicated, segmented networks rather than sharing unrestricted access to corporate systems. This reduces the potential impact if an IoT device becomes compromised.

5. Review Device Manufacturers and Firmware Sources

Consumers and IT teams should prioritize devices from established manufacturers that provide verified firmware updates and follow recognized security certification processes. Unknown or unsupported devices should not be connected to sensitive networks.

For devices suspected of being part of this operation, disconnecting them from the internet and replacing them may be necessary, as the malware can persist within the firmware.

Why This Matters?

The XCPE botnet represents a significant supply-chain security concern because the compromise occurred before devices reached consumers. Unlike traditional malware infections, users did not necessarily need to click a malicious link, install an untrusted application, or interact with a phishing message to become victims.

The incident also demonstrates how compromised consumer devices can become part of a larger cybercrime ecosystem. A single backdoor can provide access to millions of devices, which can then be monetized through advertising fraud, residential proxy networks, data collection, and additional malware distribution.

For organizations, the incident reinforces the importance of treating connected devices and IoT hardware as part of their overall cybersecurity perimeter. Device integrity, firmware verification, network segmentation, and continuous monitoring are essential to reducing supply-chain and endpoint risks.

Disclaimer: ClearPhish maintains a strict policy of not participating in the development, distribution, or operation of malware, botnets, or unauthorized proxy networks. This article is intended solely for cybersecurity awareness and informational purposes. ClearPhish does not engage in the unauthorized access, hosting, or distribution of compromised devices, malware, or stolen information.