A TV box maker built the botnet, Google says
More than 1.3 million Android devices, mostly TV set-top boxes, shipped with a backdoor run by their own maker. That is the finding of the Google Threat Intelligence Group (GTIG) report on the XCPE botnet. GTIG says it dismantled the XCPE botnet last week with industry partners and Japan’s National Police Agency.
GTIG names Videostrong Technology Co., a China-based Android device maker, as the operator. It says with “high confidence” that Videostrong built, deployed and ran the botnet on purpose, for profit. Google does not believe this was a rogue insider or a development mistake. The malware appeared in many device models and brands over several years.
What Google and its partners did
Google says it took these steps:
- It took legal action to seize the domains and servers Videostrong used to control the botnet and install malware.
- It took legal action against the command servers of more than a dozen malware families that used the backdoor.
- It cut ties with Videostrong. The company and any future subsidiaries or affiliates can no longer build or sell certified Android devices. They also cannot supply software to other certified vendors.
- It changed its review process for device makers and improved firmware integrity checks on certified Android TV devices.
Other partners named by Google include Lumen, HUMAN Security, Plume, Synthient and TrendAI. Google has not said in which court or country it filed its legal action.
The impact reaches beyond XCPE itself. Criminal “affiliates” also spread their modules through other channels. GTIG estimates that taking down their servers cuts off access to at least 10 million more infected devices.
Which devices are affected
Most infected devices are Android TV set-top boxes. GTIG also found the malware on telehealth devices, karaoke machines and digital signage. It describes the botnet as spread around the world.
Security firm Synthient, one of the partners, links the Mecool brand to Videostrong. In its Synthient research on the Mecool backdoor, it reports buying a Mecool KM9PRO Max box and finding the backdoor preinstalled. Synthient says devices sold through the YokaTV storefront carry it too. It sees the strongest presence in Malaysia, Mexico and Brazil, with victims also in the United States, China and Germany.
Synthient did the research with the Motion Picture Association (MPA). It says Mecool boxes are popular for piracy, because buyers can install third-party apps that get around copy protection.
Google and Synthient figures compared
| Detail | Google (GTIG) | Synthient |
|---|---|---|
| Infected devices | More than 1.3 million | At least 1.3 million (conservative estimate) |
| Devices online | Not stated | About half a million, contacting servers daily |
| Device types | Mostly Android TV set-top boxes, plus telehealth devices, karaoke machines, digital signage | Set-top boxes sold as Mecool and through storefronts such as YokaTV |
| Main countries | Not given; “globally dispersed” | Malaysia, Mexico, Brazil |
| Wider impact | At least 10 million other devices cut off | Not stated |
What the backdoor could do
GTIG says Videostrong sold access to infected boxes. Criminal customers then had their own malware loaded onto them. Most modules turned the box into a “residential proxy.” This means strangers’ internet traffic ran through the owner’s home connection. Proxy networks sell this kind of access to their clients.
Other modules committed ad fraud. They loaded ads in the background and fired fake views that the owner never saw. GTIG says a single device could run up to three proxy tools at once.
The operators also had direct control over the boxes. According to GTIG, they could:
- install apps silently and turn off Google Play Protect;
- run shell commands with system-level rights;
- take screenshots and inject keystrokes, much like a remote desktop session;
- scan the owner’s home network.
GTIG saw operators capture live screenshots and collect account, device, app and system log data. Synthient adds that the box sent the owner’s email address to the operators when a user was logged in.
Some proxy tools came from known services. GTIG lists Honeygain’s AppSalt SDK and says it opted users in without a consent screen. Other modules included Linkfog, GaGaNode, Traffmonetizer, EarnFM and NetNut/Popanet code.
How the malware worked
XCPE had three stages. The first, called x.cpe and sometimes com.oemservice, sits in the firmware with system rights. If a user removes it, it reinstalls itself from a protected partition on the next reboot. It reports device details to the operators, then stays connected through MQTT, a messaging protocol common in smart devices.
The second stage is a loader called com.abc.nexus that starts the money-making modules. It uses anti-analysis tricks to resist inspection. Since August 2026, the operators have been replacing it with smaller droppers disguised as Android system apps. These use an exploit to gain root access and copy themselves into the system partition.
The third stage is the modules themselves. Affiliates wrote them, not Videostrong, according to GTIG.
The key trick was timing. Google says the boxes loaded the malicious code only after their first boot. That let them slip past Google’s compatibility and security tests for device makers. Synthient found that the backdoor on its Mecool box was signed by Skyworth Digital Technology. Neither report accuses Skyworth of taking part.
Short timeline
- Late 2024: Videostrong starts moving malicious modules into com.abc.nexus, possibly after earlier Google action related to BadBox, GTIG says.
- Late 2025: Synthient buys a Mecool KM9PRO Max for analysis.
- August 2026: Operators begin swapping com.abc.nexus for disguised droppers.
- Late October 2026: Google and partners disrupt the botnet.
- November 2, 2026: GTIG and Synthient publish their reports.
How Synthient tied it to Videostrong
Synthient found an open directory on a server the botnet used. It held backdoor files and a signed document from Videostrong’s R&D director. The firm also says videostrong.cn pointed to the same IP address as the operators’ admin panel. Several Videostrong email addresses signed the backdoor files.
What to do if you own an Android TV box
Neither Google nor Synthient offers a simple check for home users. GTIG does publish long lists of file hashes, app names and server addresses. Security teams can use them to scan networks. The reports give this advice:
- Check the brand. Synthient names Mecool and YokaTV boxes. Google advises buying only from reputable makers and points to the list of certified Android TV partners.
- Unplug and dispose. Synthient tells owners to permanently dispose of affected devices, as they likely contain more malware.
- Change passwords. Synthient recommends new Wi-Fi passwords and updated router and device firmware.
- Check your IP address. Synthient suggests online services that show whether your IP is being used as a residential proxy.
- Isolate smart devices. Keep IoT gadgets on a separate network, away from computers and phones.
- Keep Play Protect on. Google also warns against apps that pay you for “unused bandwidth.”
heise pointed out a weak spot in the advice to buy from reputable makers. Videostrong itself was a certified Android device maker.
What remains unclear
Google has not said where it filed its legal action or what it is asking the court for. It has not explained how it will enforce the ban on future Videostrong affiliates. It is also unclear whether retailers will pull Mecool and similar boxes, as Synthient urges.
GTIG itself says this is not the end. It calls the underlying illicit market “resilient.” Backdoor makers, ad fraud rings and proxy sellers form one connected supply chain, the group says. GTIG wants retailers to demand independent security audits of device makers and proxy firms to prove user consent.
