Google cuts off the XCPE Android botnet and bars Videostrong devices

Google and industry partners have dismantled the XCPE botnet after linking it with more than 1.3 million Android TV streaming boxes. The company says the malware was built into devices made by Videostrong Technology Co and used to generate revenue through cybercrime.

Google says the disruption also cut off command-and-control servers tied to more than a dozen related malware families, which affected at least 10 million additional compromised devices. Those other infections reached retail set-top boxes, karaoke machines, and telehealth hardware, and not all of them ran Android.

The XCPE botnet was built into firmware during manufacturing

Google says the malware was not spread through the usual route of device vulnerabilities or tricked installs. Instead, it was embedded directly into firmware during manufacturing, then kept evolving across multiple brands and models for years.

The main backdoor is tracked as x.cpe and com.oemservice, and it runs with Android system-level privileges. The malware separates its backdoor functions from the modules that generate money for affiliates, which made the infection useful both as access malware and as a revenue platform.

Once an infected device starts, XCPE contacts a command-and-control server on the anyevonline[.]com domain to collect connection details and credentials for an MQTT broker. Google says different subdomains of anyevonline[.]com were used depending on the Android version and device type, while the broker at mqtt.szbboys[.]com was used to send commands and deploy more malware.

Operators could silently install Android apps, disable Google Play Protect, run shell commands and scripts with system privileges, capture screenshots, inject keystrokes, collect account data and system logs, and perform network reconnaissance. They could also establish reverse shells, and the devices were used to install modules from other operators as well.

Revenue modules and follow-on malware widened the abuse

Google says the botnet also carried modules linked to residential proxy services such as Linkfog, AppSalt/Honeygain, GaGaNode, NetNut, and Traffmonetizer. Those tools routed third-party internet traffic through infected devices without the owners’ knowledge or consent.

Other modules generated ad fraud by creating ad impressions, loading hidden webpages, and clicking ads. Some modules installed extra backdoors, including Moyu, Spirit, and Bird, so they could download and run more malware. Google says the operators kept changing the malware’s architecture to avoid detection.

In late 2024, Videostrong switched to a separate loader called com.abc.nexus, which handled the malicious modules while XCPE stayed focused on communication with the C2 infrastructure. Since August 2026, the operators have been replacing that loader with smaller droppers disguised as Android system applications.

How researchers tied the campaign to Videostrong

Synthient says it connected the XCPE backdoor and infrastructure to Videostrong after finding the malware preinstalled on a MECOOL KM9PRO Max Android TV box bought in late 2025. During its investigation, it found a public directory on the malware’s file.anyevonline[.]com server that hosted backdoors used by the operators.

That directory also held a PDF folder containing a document by Owen Cao, the R&D director of Videostrong Technology Co. Researchers also found that Videostrong’s videostrong[.]cn domain pointed to the same IP address as mqtt.anyevonline[.]com, the server used to list compromised devices, push commands, and manage app installations. Synthient also found that many Videostrong company email addresses had been used to sign the backdoors.

Google says the evidence points to deliberate installation rather than a rogue employee or a development mistake. The company says it has also changed its certification review process after finding that Videostrong used obfuscation to evade security testing and load malicious code after first boot.

Clean firmware is needed to remove the infection

Google says the takedown disrupted XCPE’s operations, but the malware remains on infected devices. It will reinstall itself from the /oem/ partition if removed, so users would need to install clean firmware or disconnect the affected device from the internet to stop further malicious activity.