Google Disrupts Backdoors in Over 1.3 Million Android Devices, Deliberately Planted by Manufacturer Videostrong

Backdoors were embedded in the firmware of more than 1.3 million Android devices during manufacturing. Google assessed that manufacturer Videostrong deliberately developed and operated them and revoked its certification eligibility; Japan's National Police Agency also participated in the international effort.

Key points

• What happened: Google disrupted "XCPE," a botnet encompassing more than 1.3 million Android devices; manufacturer Videostrong had deliberately embedded backdoors in their firmware
• Why it matters: Infected devices were turned into residential proxies, abusing users' home connections as routes for criminal traffic; more than 3.8 million IP addresses were used as criminal infrastructure over four months
• What remains: Malware remains on devices after the disruption; this case shows that even Android certification did not guarantee the integrity of the manufacturing process

A backdoor planted by the manufacturer

Google Threat Intelligence Group (GTIG) took legal action and disrupted communications infrastructure targeting "XCPE," a botnet incorporating more than 1.3 million Android devices. Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI assisted in the investigation.

A typical malware infection occurs when a user installs a malicious app. XCPE is different. It was built directly into device firmware during manufacturing.

Google assesses with "high confidence" that Videostrong Technology Co., a device manufacturer based in Shenzhen, China, deliberately developed, deployed, and operated the backdoor.

We believe this was neither individual misconduct nor a development oversight

Videostrong designs and manufactures devices for other brands as an OEM (original equipment manufacturer) and ODM (original design manufacturer). Research by security company Synthient attributed devices sold under consumer brands "MECOOL" and "YOKATV" to the company. The brand printed on a device may not reveal that Videostrong developed its firmware.

Most infections involve television set-top boxes, but infected telemedicine devices, karaoke equipment, and digital signage were also identified. XCPE belongs to the same ecosystem as "BadBox 2.0 (in Japanese)," a botnet of more than 10 million devices disrupted in March 2025.

A mechanism that resists removal

At XCPE's core is a component called x.cpe (com.oemservice in some builds), which runs with Android system privileges (android.uid.system). It is preinstalled in the firmware's system area, and even if a user removes it as an app, it automatically reinstalls from the /oem/ partition on reboot. It cannot be removed through normal operations.

After startup, the backdoor connects to an external server over HTTP, sends device identifiers and firmware versions, and retrieves configuration data. Communications use AES-encrypted JSON. It then establishes a persistent connection to a command server through MQTT, a lightweight messaging protocol widely used by IoT devices, and waits for remote commands.

The identified capabilities are extensive: installing apps without user consent, executing commands with system privileges, capturing screens, sending keystrokes, collecting device and account information, surveying home networks, and establishing reverse shells. Researchers also identified functionality to disable Google Play Protect, Android's app verification feature. Specifically, it stops app verification by changing the Android global setting package_verifier_user_consent to -1. This allowed additional malicious programs to run through the device without detection.

Videostrong also evaded certification checks. According to Google, it used obfuscation to exploit gaps in certification testing and load malicious code after a device's first boot. Google has responded by improving the review process for firmware integrity on certified Android TV devices.

The malware's architecture continued to evolve. From late 2024, it shifted from a simple design to a three-stage modular structure consisting of the backdoor, a loader, and monetization modules. From August 2026, it became smaller still, deploying droppers disguised as Android system apps such as com.android.system.ntp.

Synthient's investigation also uncovered specific attribution evidence. A public directory left on XCPE command server file.anyevonline[.]com contained documents signed by Videostrong's head of R&D, Owen Cao. Videostrong's official domain, videostrong[.]cn, also pointed to the same IP address as MQTT command server mqtt.anyevonline[.]com, and multiple Videostrong employees' email addresses were used to sign the backdoor.

Home connections used for crime

Videostrong sold access to the backdoor to criminal groups, or affiliates, each of which deployed its own monetization modules on infected devices.

A particularly serious use was as residential proxies, turning infected devices into exit points for third-party traffic. To external services, criminals' traffic appeared to originate from ordinary household IP addresses. Users unknowingly became routes for unauthorized access and fraud. Modules associated with residential proxy services including Linkfog, AppSalt (Honeygain), NetNut, and Traffmoneizer were identified, with some devices running three residential proxy SDKs simultaneously.

Modules for fraudulent ad displays and clicks were also distributed, along with additional backdoors such as Moyu, Spirit, and Bird.

TrendAI's observations quantify the scale of this criminal infrastructure. Over roughly four months from June 3 to October 1, 2026, more than 3.8 million residential and mobile IP addresses were used for XCPE-related communications. About 180,000 IP addresses were available as residential proxies on an average day, peaking at about 370,000. Researchers captured more than 2.3 billion control messages during the same period. Infected devices also collected home network information such as Wi-Fi details and Bluetooth settings. Behind the television programs their owners watched, these devices were operating as part of criminal infrastructure.

The disruption and the problems left behind

Google's legal action had two parts. One disrupted the domains and servers Videostrong used to control the botnet. The other disrupted command domains for more than a dozen malware families distributed through XCPE. Because the latter also spread through channels other than XCPE, Google estimates that this action can cut attackers' access to at least 10 million additional infected devices. That figure does not mean malware was removed from the devices. Rather, blocking their communications destinations hampered attackers' ability to send new commands and monetize infections.

Google terminated its business relationship with Videostrong and prohibited the company, its future subsidiaries, and affiliates from manufacturing certified Android devices or supplying software to certified manufacturers.

Synthient estimates that about 500,000 of the more than 1.3 million infected devices are actively online, concentrated in Malaysia, Mexico, and Brazil. TrendAI observed 206 models across more than 170 countries, with tens of thousands of infections each in the United States, Germany, and the United Kingdom.

Figure omitted — see the original article

Japan's National Police Agency participated in the international effort. However, Google's public materials do not identify infection numbers in Japan or specific models sold there.

The operation blocked command servers but did not remove malware remaining on infected devices. Malicious code stored in the /oem/ partition returns on reboot even after deletion. Synthient recommends disposing of infected devices; at minimum, replacing the firmware with a safe version or disconnecting the device from the network is necessary.

This case highlights the distinction between a label saying a device runs Android and actual Google certification. Anyone can use Android's open source code, and inexpensive devices with custom firmware circulate worldwide. Even on certified devices, previous inspection systems could not fully detect what was embedded in firmware during manufacturing. Checking the manufacturer, Google certification status, and availability of firmware updates, rather than relying on brand names or prices, is necessary for every Android device connected to a home network.

Originally published on Joho no Todai. The Japanese original is here.