Google disrupts XCPE botnet on 1.3M Android TV boxes

Google has disrupted XCPE, a botnet running on more than 1.3 million Android TV streaming boxes, and terminated its relationship with Chinese manufacturer Videostrong Technology Co, which Google says built and operated the backdoor for financial gain. Google attributes the operation to Videostrong "with high confidence." If you run cheap off-brand Android TV hardware on a network you care about, treat those devices as compromised until proven otherwise.

What's affected

Per Google's analysis, as reported by BleepingComputer and The Hacker News:

• 1.3 million+ Android TV boxes carried the XCPE backdoor directly. The takedown of XCPE's command-and-control infrastructure also cut access to at least 10 million additional devices compromised through more than a dozen related malware families — set-top boxes, karaoke machines, and telehealth hardware among them.
• The malware is embedded in device firmware during manufacturing — not spread through a vulnerability or user action. The core components x.cpe and com.oemservice run with Android system-level privileges.
• It persists at the partition level: Google says it "automatically reinstalls itself from the /oem/ partition if removed," so a factory reset does not clear it. Clean firmware or disconnecting the device from the internet is required.

These are not devices that receive security updates. The infection ships from the factory.

How it monetized

XCPE is modular. Google describes separate modules that generate revenue for affiliates: residential-proxy services (Google names Linkfog, AppSalt/Honeygain, GaGaNode, NetNut, and Traffmonetizer), ad fraud, and backdoor modules tracked as Moyu, Spirit, and Bird. Capabilities include disabling Google Play Protect, executing shell commands, capturing screenshots, and opening reverse shells. From late 2024 a loader named com.abc.nexus ran the modules; since August 2026, operators have been swapping it for smaller droppers disguised as Android system apps.

What Google did

• Took down XCPE C2 infrastructure shared across the related malware families, coordinated with Japan's National Police Agency and security firms Lumen, HUMAN Security, Plume, Synthient, and TrendAI.
• Revoked Videostrong's license to manufacture Android TV devices with preloaded Google apps and services, and banned the company and future affiliates from producing certified Android devices or supplying software to certified vendors.
• Changed its certification review process.

Indicators

From Google's analysis, as reported by BleepingComputer (defanged):

anyevonline[.]com        # XCPE C2
mqtt.szbboys[.]com       # MQTT broker
x.cpe / com.oemservice   # system-level backdoor components
com.abc.nexus            # legacy module loader (pre-Aug 2026)

Action checklist

1. Inventory off-brand streaming hardware on networks you operate — guest Wi-Fi, lab environments, lobby TVs, telehealth kit. Firmware-level malware is invisible to endpoint agents on other hosts.
2. Segment or remove uncertified Android TV devices. If the device cannot be reflashed with clean firmware, the practical fix is to take it off the network.
3. Watch for the C2 domains and MQTT broker above in DNS and egress logs.
4. Prefer Play Protect-certified devices. Google's certification revocation is the signal that uncertified hardware from this supply chain is untrusted by default.

Context

This is the supply-chain variant of the botnet problem: the compromise is baked in before the box is sold, which is the same pattern as the BadBox and BadBox 2.0 campaigns that seeded malware into Android TV hardware at manufacture. What's new here is the attribution — Google naming the manufacturer itself as the operator, rather than a third party poisoning an otherwise-legitimate supply chain, and using its certification program as the lever. Synthient's investigation cites a document by a named Videostrong R&D director found in an open directory on the malware's own server; no criminal charges have been filed in the reporting so far.