Google Dismantles XCPE Botnet Hidden in 1.3 Million Android TV Boxes

The discovery that a single electronics manufacturer secretly turned over a million Android TV devices into a botnet has sent shockwaves through the cybersecurity community. Google’s Threat Intelligence Group recently announced the takedown of the XCPE botnet, a sprawling malware operation that ran on more than 1.3 million certified Android TV set-top boxes manufactured by Shenzhen-based Videostrong Technology.

How the XCPE Botnet Worked

The XCPE botnet represents one of the most brazen supply-chain malware operations ever uncovered. What makes this case particularly alarming is that the infected devices were Google-certified Android TV boxes, meaning they had passed Google’s official compatibility and security screening process. Videostrong, an Android Original Equipment Manufacturer and Original Design Manufacturer, managed to evade detection by employing obfuscation techniques that exploited a gap in Google’s testing framework.

According to Google’s analysis, the company intentionally built the backdoor directly into the firmware of its devices. After a device was set up and connected to the internet, a stub application called x.cpe or com.oemservice would silently phone home to Videostrong’s command-and-control servers. This stub application had no malicious capabilities of its own, but it possessed the system-level permissions necessary to install additional malware modules at the operator’s discretion.

The first thing the stub did was disable Google Play Protect, the built-in security scanner that would have otherwise flagged the silently installed packages as malicious. With Play Protect neutralized, the XCPE platform evolved from a simple single-stage dropper into a sophisticated modular three-stage malware platform that sold access to third-party criminal affiliates.

The Scale of the Operation

The numbers are staggering. Google estimated that at its peak, the XCPE botnet ran on more than 1.3 million infected devices. Trend Micro’s independent count was even higher, identifying a total of 1,472,554 compromised devices. The overwhelming majority of infected boxes were concentrated in Brazil, Malaysia, Iraq, Mexico, and Taiwan, but tens of thousands were also active in the United States, Germany, the United Kingdom, Australia, and Canada.

Synthient, one of Google’s disruption partners, published a list of 182 device model names known to be included in the botnet. Most were sold under the MECOOL brand, though white-label Android TV boxes of unknown origin were also affected. The devices were primarily sold through online marketplaces, making it difficult for consumers to know whether their hardware was compromised.

How Videostrong Monetized the Botnet

Videostrong monetized the backdoor through a multi-pronged approach that turned infected devices into revenue-generating assets for criminal affiliates:

• Residential proxy networks: Most infected devices were enrolled as residential proxies, routing large volumes of nefarious internet traffic through unsuspecting users’ home networks. This traffic included credential stuffing, ad fraud, and other automated attacks that benefited from appearing to originate from legitimate residential IP addresses.
• Ad fraud schemes: Many devices ran modules that engaged in sophisticated advertising fraud, generating fake ad impressions and clicks that drained advertising budgets from legitimate businesses.
• Full device access: Videostrong retained complete access to every infected device, allowing operators to run terminal commands, capture screenshots, and probe other devices on the local network. Google reportedly observed Videostrong doing this in real time.

The company essentially operated a malware-as-a-service platform built into hardware it manufactured, selling access to criminal affiliates who loaded their own malware modules onto infected devices. This is a fundamentally different threat model than traditional malware distribution, because the manufacturer itself was the threat actor.

The Malware’s Technical Evolution

The XCPE malware evolved significantly over time. Since August 2026, new dropper packages began appearing via an MQTT channel, synchronized with mass-uninstallation of a package called com.abc.nexus across the botnet. These new packages were disguised as legitimate Android system applications with names such as com.android.system.ntp and com.android.sso.auth.handler.

Where earlier XCPE components served as a general-purpose loader and execution engine, these newer packages took a different approach. Multiple variants extracted a native ELF file called libexploit.so, which executed functions named nativeAdbRoot() and nativeAdbShell(). These functions restarted the local Android Debug Bridge daemon as root and initiated an ADB shell connection. The app then used this connection to install itself in the system partition, remounting the /system partition as read-write and replicating itself to a new directory in /system/priv-app/.

This escalation meant the malware achieved persistent root-level access that survived factory resets, making it extraordinarily difficult for average consumers to remove.

Google’s Response and Takedown Operation

Google worked with several partner organizations to disrupt the XCPE network, including Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and Trend Micro. The takedown involved:

• Taking legal action to shut down the domains and servers Videostrong used to operate and install its malware
• Disrupting command-and-control servers operated by Videostrong that were connected to other malware campaigns
• Severing Videostrong’s access to approximately 10 million additional compromised devices beyond the XCPE botnet itself
• Terminating the business relationship with Videostrong and banning the company from manufacturing devices with preloaded Google apps
• Implementing changes to the Android certification review process to prevent similar attacks in the future

Google assessed with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain. The company concluded this was not an isolated rogue insider or a development oversight, but a deliberate corporate strategy.

What This Means for Consumers

The takedown should make affected devices safer, but significant problems remain. Play Protect is still disabled on many infected devices, and inert malware modules are still installed. Because they were loaded as system apps, users cannot easily remove them through normal settings menus.

Anyone who has purchased a MECOOL or white-label Android TV box of unknown origin should check whether their device appears on Synthient’s published list of 182 affected model names. If it does, the safest course of action is to stop using the device for any sensitive activities and consider replacing it with hardware from a reputable manufacturer.

The Bigger Picture: Hardware Supply Chain Threats

The XCPE botnet highlights a growing concern in cybersecurity: hardware supply chain attacks where the manufacturer itself is the threat actor. Traditional security advice focuses on avoiding malicious downloads and phishing emails, but when the device arrives pre-infected from the factory, those defenses are irrelevant.

This case also demonstrates how the open nature of Android creates both opportunities and risks. While Android’s openness has enabled a diverse ecosystem of affordable devices, it also means that countless uncertified Android-based TV boxes enter the market with no oversight. Videostrong could continue selling malicious hardware under other brands without Google apps, though it would need to rebuild its malware operation from scratch.

For organizations, the XCPE botnet reinforces the importance of network segmentation and treating IoT devices as untrusted by default. Any device that joins a corporate or home network should be isolated from sensitive systems, and traffic from consumer electronics should be monitored for unexpected outbound connections.

Key Takeaways for Security Professionals

• Device certification is not a guarantee of safety. Even Google-certified devices can harbor pre-installed malware if the manufacturer is sophisticated enough to evade testing.
• Residential proxy networks remain a major monetization vector. Attackers value compromised consumer devices for their ability to route traffic through legitimate residential IP addresses.
• MQTT-based command-and-control is increasingly common in IoT malware, offering lightweight, persistent communication channels that are difficult to block.
• System-level persistence requires system-level removal. When malware installs itself in the system partition, standard remediation tools are insufficient.
• Manufacturer accountability matters. Google’s decision to cut ties with Videostrong sets an important precedent, but the certification gap that allowed this to happen needs sustained attention.

The XCPE botnet takedown is a significant victory for the cybersecurity community, but it also serves as a wake-up call. As Internet of Things devices proliferate in homes and businesses worldwide, the attack surface grows. When the manufacturer is the attacker, the entire trust model of certified hardware comes into question. Security teams must assume that any connected device could be compromised and design their defenses accordingly.

---

Edited by Palawan @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous