Google and industry partners have dismantled the XCPE malware botnet consisting of more than 1.3 million Android TV streaming TV boxes that Google says its manufacturer intentionally infected with malware to generate revenue through cybercrime activities.

The company attributes the botnet with high confidence to Chinese device manufacturer Videostrong Technology Co, accusing the company of deliberately installing a persistent backdoor into devices it manufactured and selling access to criminal affiliates.

These affiliates used the backdoored devices to deploy malicious modules that were used fir ad fraud, turned infected devices into residential proxies, and installed additional malware.

As part of the disruption, Google says it took down XCPE command-and-control (C2) servers used by more than a dozen related malware families, cutting off access to at least 10 million additional compromised devices.

These additional devices were compromised through malware distributed through other means than XCPE, and include retail set-top boxes, karaoke machines, and telehealth hardware. Google says that not all of them are Android devices.

Google has also terminated its relationship with Videostrong, revoked its license to manufacture Android TV devices with preloaded Google apps and services, and banned the company and its future affiliates from producing certified Android devices or supplying software to certified vendors.

"We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.," Google's Threat Intelligence Group (GTIG) said in a report published Monday.

Google says the disruption involved Japan's National Police Agency and security companies Lumen, HUMAN Security, Plume, Synthient, and TrendAI, which coordinated to analyze the malicious infrastructure and disrupt its operations.

The XCPE botnet

Unlike other botnets that commonly breach devices through vulnerabilities or by tricking users into installing malware, the XCPE botnet was embedded directly into device firmware during manufacturing.

Google says Videostrong had been developing and distributing the malware across multiple device brands and models for years, evolving its capabilities to evade detection and support different criminal affiliates.

"We found this malicious software built directly into many different device models and brands over multiple years, supported by dedicated infrastructure and constantly evolving configurations to evade detection and manage their affiliates," Google says.

The main backdoor component, tracked as x.cpe and com.oemservice, run with Android system-level privileges.

The malware uses a modular architecture that separates its backdoor functions from modules designed to generate revenue for affiliates.

After an infected device starts, XCPE contacts a command-and-control server on the anyevonline[.]com domain to obtain connection information and credentials for an MQTT message broker, which is then used for receiving commands.

Google says the malware uses different subdomains of anyevonline[.]com depending on the Android version and device type. The MQTT broker, which was hosted at mqtt.szbboys[.]com, allowed operators to send commands and deploy other malware to infected devices.

Through this connection, operators can remotely control compromised devices and perform malicious actions, such as:

• Silently downloading and installing additional Android applications.
• Disabling Google Play Protect.
• Executing shell commands and scripts with system privileges.
• Capturing screenshots and injecting keystrokes.
• Collecting account information, device details, installed application lists, and system logs.
• Conducting network reconnaissance and establishing reverse shells.

The devices were also used to generate revenue by installing malware modules belonging to other operators, turning the backdoor into a plug-in cybercrime platform for other cybercriminals.

According to Google, these modules included software associated with residential proxy services such as Linkfog, AppSalt/Honeygain, GaGaNode, NetNut, and Traffmonetizer, which was used to route third-party internet traffic through infected devices without their owners' knowledge or consent.

Other modules committed ad fraud by generating ad impressions, loading hidden webpages, and clicking advertisements. Some modules installed other backdoors, including Moyu, Spirit, and Bird, to download and execute other malware.

Google says the botnet operators continuously changed the malware's architecture to avoid detection.

In late 2024, Videostrong began using a separate loader called com.abc.nexus, which ran the malicious modules while XCPE focused on communications with the C2 infrastructure.

Since August 2026, the operators began replacing that loader with smaller, specialized droppers disguised as Android system applications.

Videostrong attribution

In a separate coordinated report, cybersecurity firm Synthient explains how it traced the XCPE backdoor and infrastructure to Videostrong after discovering the malware preinstalled on a MECOOL KM9PRO Max Android TV box purchased in late 2025.

During its investigation, Synthient found a publicly accessible directory on the malware's file.anyevonline[.]com server that hosted backdoors used by the operators. The open directory also included a PDF folder containing a PDF by Owen Cao, the R&D director of Videostrong Technology Co.

Researchers also found that Videostrong's videostrong[.]cn domain pointed to the same IP address as mqtt.anyevonline[.]com, the command-and-control server that allowed operators to list compromised devices, push out commands, and manage application installations.

In addition, Synthient discovered that numerous Videostrong company email addresses had been used to sign the backdoors.

Google says the evidence indicates the manufacturer deliberately installed the malware rather than a rogue employee or a development oversight.

"We believe this campaign wasn't an isolated rogue insider or a development oversight," Google said.

Google also says it has modified its certification review process after discovering that Videostrong used obfuscation techniques to evade security testing and load malicious code after devices first booted.

While Google says the takedown has disrupted XCPE's operations, the malware has not been removed from in infected devices and will automatically reinstalls itself from the /oem/ partition if removed.

As a result, users would need to install clean firmware to remove the infection or disconnect the affected device from the internet to prevent further malicious activity.

BleepingComputer has contacted Google with additional questions about the botnet and will update the story if we get a response.

Uncover email threats your existing defenses may miss.

Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.

See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.

Start your free email security scan.