XCPE Botnet Hid in 1.3 Million Certified Android TV Boxes

The XCPE botnet was dismantled last week after Google found a backdoor built directly into the firmware of more than 1.3 million Android TV set-top boxes. Google Threat Intelligence Group published its findings Monday and named the manufacturer: Videostrong Technology Co., a Shenzhen-based Android OEM and ODM.

Google assesses with high confidence that the XCPE botnet was intentionally developed, deployed, and operated for financial gain by Videostrong itself. The company rejects the more comfortable explanations. “We believe this campaign wasn’t an isolated rogue insider or a development oversight,” Google wrote.

How the Backdoor Worked

The malware sat in the firmware partition and ran at android.uid.system, the highest privilege level available on Android. It answered to two package names, x.cpe and com.oemservice, depending on the build. Deleting it accomplished nothing, because the XCPE botnet reinstalled itself from the /oem/ partition on the reboot.

A second package, com.abc.nexus, handled module execution and used native anti-analysis code to resist sandboxing. Google traces the architecture to at least late 2024, when Videostrong moved from simple droppers to a modular three-stage design, apparently in response to earlier enforcement against BadBox.

Command and control ran in two stages: an HTTP request to fetch configuration, then a persistent MQTT connection on non-standard ports to receive instructions.

What Operators Could Do

The published command list is not subtle. Operators could install apps silently, run arbitrary shell commands as root, download and execute scripts, map the victim network, and capture the screen continuously as compressed JPEGs.

One capability deserves its own line. The XCPE botnet disabled Google Play Protect by writing -1 to the package_verifier_user_consent setting, which turned off app verification before any payload landed.

Google also observed operators taking live screenshots, injecting keystrokes, pulling account information, device inventories and system logs, and opening reverse shells on infected hardware.

Monetization came through criminal affiliates who bought access to the XCPE botnet and had their own modules loaded onto it. Those modules turned infected boxes into residential proxy exit nodes, including Linkfog, AppSalt, NetNut, GaGaNode, Traffmonetizer and EarnFM. Others committed ad fraud, among them HiddenView, which ran headless WebViews to fire fake impression beacons without ever displaying an ad.

Devices were stacked rather than shared. Google found as many as three residential proxy SDKs running on a single box.

It Was Not Only TV Boxes

The overwhelming majority of the XCPE botnet was Android TV set-top boxes, but Google also found telehealth devices, karaoke machines and digital signage running the same code. Synthient, one of the research partners, compiled a list of potentially affected models with the Mecool brand as the focus.

Google took legal action against the domains and servers Videostrong used to operate the backdoor, plus command and control infrastructure belonging to more than a dozen affiliate malware families. It banned Videostrong and any future subsidiaries from building or selling certified Android devices, or from supplying software to other certified vendors. It also changed how it verifies firmware integrity on certified Android TV hardware.

The company worked with Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI.

Google concedes the failure was partly its own. Videostrong used obfuscation to load malicious code after the device’s first boot, which slipped past compatibility testing that ran earlier in the process.

The Ten Million Figure

Coverage of the XCPE botnet is already blending two numbers. The 1.3 million refers to infected set-top boxes. The 10 million refers to devices compromised by affiliate modules distributed outside XCPE, which Google expects to lose command access now that those servers are gone. They are separate populations, and the second one is a projection, not a count of XCPE victims.

What Owners Should Do

Google says the takedown of the XCPE botnet should leave affected boxes safe to use, but recommends purchasing connected devices only from reputable manufacturers and checking its certified partner list before buying.

Its broader warning concerns apps that pay users for unused bandwidth or shared internet, which Google describes as a primary growth channel for illicit proxy networks.

The XCPE botnet enrolled more than 1.3 million certified set-top boxes

Google blames Videostrong, now banned from building certified Android devices

The backdoor ran at system level and reinstalled itself after deletion

Affiliates used infected boxes for residential proxies and ad fraud

The 10 million figure covers other devices, not the XCPE botnet

This is the rare supply chain case where the platform accuses its own manufacturing partner of deliberate fraud rather than negligence. The uncomfortable lesson is that certification tested the wrong moment. Videostrong behaved during review and misbehaved after first boot, and the XCPE botnet lived in that gap.

What do you think this Android TV security failure? Drop a on your favorite platform below, and let’s !

In some of our articles and especially in our reviews, you will find Amazon or other affiliate links. As Amazon Associates, we earn from qualifying purchases. Any other purchases you make through these links often result in a small amount being earned for the site and/or our writers. Techaeris often covers brand press releases. Doing this does not constitute an endorsement of any product or service by Techaeris. We provide the press release information for our audience to be informed and make their own decision on a purchase or not. Only our reviews are an endorsement or lack thereof. For more information, you can read our full disclaimer .