Google said on November 2 that TV box maker Videostrong intentionally built a backdoor into more than 1.3 million Android set-top boxes. The company then sold access to criminals, and the backdoor survives last week’s takedown.
At a Glance
- Google’s Threat Intelligence Group attributes the x.cpe backdoor to Videostrong with high confidence and has cut ties with the company.
- Legal action took down the botnet’s control servers and the command domains of more than a dozen malware families.
- Google expects the affiliate takedowns to cut criminal access to at least 10 million more infected devices.
- TrendAI counted 1,472,554 infected devices across 206 models and says owners cannot remove the implant themselves.
The maker rented its own boxes to criminal affiliates
Videostrong, a Shenzhen company, sells Android TV boxes under its MECOOL brand and builds devices for other labels. Google found x.cpe preloaded across many models and brands over several years. It ruled out a rogue insider or a development oversight.
“A device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust,” Google wrote in its report.
The backdoor runs with system privileges inside the firmware. Uninstall it, and it reinstalls from the /oem/ partition on the next reboot. It also disables Google Play Protect app checks by setting “package_verifier_user_consent” to -1.
Operators drove it over MQTT, a lightweight messaging protocol, to install apps silently, run shell commands, capture the screen and map home networks. Google said it saw Videostrong operators take live screenshots, inject keystrokes, pull account details and system logs, and open reverse shells.
Most paid add-ons turned boxes into residential proxy exit nodes. These rent out a household’s connection, so a customer’s traffic looks like it comes from an ordinary home. Proxy modules included Linkfog, AppSalt, NetNut and Traffmonetizer, while HiddenView faked ad views.
Some boxes ran up to three proxy SDKs at once. The AppSalt SDK, owned by Honeygain, set a consent flag without showing the user any screen.
Google and partners just shut the door on the XCPE botnet, severing criminal access to 10M+ devices. 🛡 Instead of a hacker breaking in, a device maker hid a backdoor in its own TV boxes to sell access to cybercriminals. Full story: https://t.co/9gBcoGa0bG https://t.co/sPqfJn7mor
— Google Cloud Security (@GoogleCloudSec) November 2, 2026
TrendAI, Trend Micro’s enterprise business unit, counted 1,472,554 infected devices across 206 models between June 3 and October 1. It calls every figure a lower bound. Malaysia, Brazil, Iraq, Mexico and Taiwan led the count, while the U.S., Germany, the U.K., Australia and Canada each logged roughly 26,000 to 42,000. Google also found x.cpe on telehealth devices, karaoke machines and digital signage.
Certified boxes slipped past Google’s tests
Videostrong hid its code to exploit a gap in Android’s compatibility and security tests, Google said, loading the payload after a device’s first boot. Google has since changed its review process and is tightening firmware integrity checks on certified Android TV devices.
Google tied x.cpe to Videostrong’s own YokaTV Player app and to a GitHub account named yf-videostrong that hosted payloads. Synthient reached the same high-confidence call. It cited a document signed by Videostrong’s R&D director, found in an open folder on a botnet server. A Videostrong domain also shared an IP address with the operators’ control panel.
Google banned Videostrong and any future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors. Videostrong’s website still listed a “Google Certified Android TV Box” and a “Google Certified Android TV Stick” as of November 2.
Plume, which makes Wi-Fi software for internet providers, said the botnet included both Google-certified devices and AOSP (Android Open Source Project) builds. Google’s report leaves two questions open: how many certified devices were infected, and whether Videostrong will ship firmware without x.cpe.
For owners, TrendAI says cleanup “needs vendor action, platform protection or replacement of the device.” Plume recommends a full factory reset because modules may have planted extra backdoors, though it does not say a reset removes x.cpe. Synthient tells consumers to discard the boxes. It has published 182 model names seen in the campaign and warns that a model name alone does not confirm infection.
What’s Next?
For organizations, the partners’ guidance helps reduce risk:
- Find MECOOL and similar boxes with the published indicators, then disconnect them.
- Block the listed control infrastructure, including mqtt.szbboys[.]com and broker IPs 219.134.163[.]210 and 219.134.163[.]211.
- Put smart devices on separate network segments.
- Route remote staff’s corporate access through managed devices, as TrendAI advises.
Since August, operators have also pushed droppers disguised as system apps, such as com.android.system.ntp. These root the box over ADB (Android Debug Bridge) and copy themselves into /system/priv-app/. The servers behind those orders are offline. The code that dials them still sits in the firmware and returns after every reboot.
