Google dismantled a global cybercrime network known as the XCPE botnet after discovering that hardware partner Videostrong Technology Co. built persistent backdoors into more than 1.3 million Android devices [1]. The company cut ties with Shenzhen vendor Videostrong on November 2, 2026 [3]. Preinstalled firmware allowed operators to hijack consumer broadband connections for ad fraud schemes without subscriber knowledge or consent [5].
How the XCPE Botnet Entered Consumer Hardware
Unlike ordinary malware that spreads through shady web links or app stores, the XCPE botnet began on the factory floor when Videostrong secretly put rogue code into firmware during device assembly in Shenzhen [1]. Lab audits missed it completely. Google said that the vendor concealed its components to bypass automated compatibility and security audits, deliberately delaying payload activation until after a user completed the initial device boot [2]. That simple trick let Videostrong sell compromised TV hardware for multiple years without failing certification tests [1].
The rogue firmware affected gear well beyond living room TV boxes. Threat intelligence teams at Plume and TrendAI also discovered the hidden backdoor operating on commercial digital signage displays, home karaoke machines, and connected telehealth hardware across several retail markets [1]. Videostrong put these modified Android Open Source Project builds onto dozens of white-label brands [2].
While Google built AI defenses against messaging scams in the Android system, firmware exploits bypass operating system security before user protections activate. Google Cloud researchers said the backdoor was not a coding error or the work of a rogue employee. “We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.,” Google said [3].
Backdoors and Secondary Malware in the Firmware
At the core of the campaign sits a primary backdoor known as x.cpe or com.oemservice, which runs with system-level privileges to capture screenshots, execute shell commands, and disable Google Play Protect checks [3]. It fetches instructions using MQTT [4].
Through an MQTT broker hosted at mqtt.szbboys[.]com, Videostrong operators loaded affiliate malware modules that routed third-party traffic through home internet connections via residential proxy networks like Linkfog, AppSalt, Honeygain, GaGaNode, NetNut, and Traffmonetizer [3]. This turned consumer hardware into proxy nodes [4]. Some boxes ran up to three proxy development kits at the same time, while other tools clicked ads silently to steal brand budgets, scraped web pages, or installed secondary backdoors called Moyu, Spirit, and Bird. Operators also used reverse command shells to pull account credentials, device details, and system logs without alerting device owners [3].
Videostrong shifted its code over time to slip past security teams. In late 2024, the team added a separate loader named com.abc.nexus to run proxy modules while x.cpe handled server chat. In August 2026, the crew swapped that loader for smaller droppers disguised as normal system apps [3]. Strange spikes in background home data also happened when Google Home speakers quietly downloaded hundreds of gigabytes of unexplained files.
Global Infection Scale and Affected Device Brands
Network telemetry proved that rogue firmware reached living rooms worldwide [5]. Telemetry collected by TrendAI, the enterprise security unit of Trend Micro, documented 1,472,554 infected devices spanning 206 individual hardware models between June 3 and October 1, 2026 [2]. Synthient estimated that 500,000 devices stayed online simultaneously [4].
Compromised boxes turned up in over 200 countries, with the biggest clusters found in Malaysia, Brazil, Iraq, Mexico, and Taiwan. Substantial device totals also surfaced in the United States, Germany, the United Kingdom, Australia, and Canada, which each logged between 26,000 and 42,000 actively infected units [2]. “That’s millions of households and businesses completely unaware that their equipment was being used as an accessory in active criminality,” said Robert McArdle, cybercrime research director at TrendAI. McArdle said hijacked broadband accounts let scammers run identity theft and ad fraud schemes behind genuine family internet connections [5]. Few buyers knew their streaming player doubled as a crime tool [2].
Synthient traced the botnet to hardware sold under the MECOOL brand [2]. The firm bought a MECOOL KM9PRO Max player in late 2025 and found the backdoor preinstalled. Researchers also found internal files signed by Videostrong research director Owen Cao on an open server, while official company web domains pointed directly to the botnet command panel [3].
Dismantling the XCPE Botnet Command Servers
Disrupting the XCPE botnet required an international enforcement sweep led by Google alongside public law enforcement authorities and private cybersecurity companies [5]. Partners included Japan’s National Police Agency, network giant Lumen Technologies, Plume, HUMAN Security, Synthient, and TrendAI. Google secured court orders to take down command servers [2].
The joint raid took down servers that fed over a dozen affiliate malware groups that bought access from Videostrong [2]. Because those criminal syndicates distributed their modules through secondary channels beyond Videostrong hardware, Google estimates the domain takedown severed access to at least 10 million additional compromised devices [1]. “Operations like this raise the cost for criminals and show that the infrastructure they rely on isn’t out of reach,” said Charley Snyder, head of disruption operations at Google Threat Intelligence Group. Snyder said cross-border teamwork stops global threat actors [5].
“Compromised-device networks are sustained by profit,” said Gavin Reid, chief information security officer at HUMAN Security, emphasizing that coordinated takedowns raise costs and destroy the financial incentives supporting unauthorized proxy services [5]. Google banned Videostrong immediately. During earlier litigation over BadBox 2.0 in mid-2025, affected hardware lacked official certification entirely, making this certified breach unusual [2].
Remediation Challenges for Affected Streaming Boxes
Although the raid disabled central control servers, the backdoor stays alive on living room set-top boxes [2]. Because Videostrong embedded the backdoor into the protected /oem/ partition of system firmware, ordinary factory reset tools fail to eliminate the software, which automatically reinstalls itself whenever the device reboots. Owners can’t delete it manually [3].
Wi-Fi software vendor Plume told consumers to run a full factory reset, though researchers note that a reset can’t wipe modified system partitions. Synthient published a list of 182 hardware models tied to the botnet and told buyers to discard the boxes [2]. Benjamin Brundage, chief executive of Synthient, warned that illicit pay-per-install networks supply the core infrastructure for ad fraud and denial-of-service rings, making compromised streaming gear a lasting hazard on home Wi-Fi networks [5].
Enterprise security teams face headaches as remote staff plug infected streaming gear into home office setups. TrendAI advised corporate network administrators to treat unmanaged smart devices on employee home networks as an active attack surface, urging companies to isolate corporate laptops behind managed network segmentation [2]. Pulling the power plug remains the only reliable fix [3].
- ONLINE NEWS Bonifield, S. (2026, November 2). One of Google’s Android partners turned 1.3 million set-top boxes into a botnet. The Verge. [Article Link]
- ONLINE NEWS The Hacker News. (2026, November 2). Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access. The Hacker News. [Article Link]
- ONLINE NEWS Abrams, L. (2026, November 2). Google disrupts million-device XCPE Android malware botnet, bans TV box maker. BleepingComputer. [Article Link]
- ONLINE NEWS Mann, B. (2026, November 2). Google dismantles 1.3 million-device Android botnet, bans TV box maker. CyberInsider. [Article Link]
- PRESS RELEASE Yahoo! Finance. (2026, November 2). Industry Takedown of Botnet Hidden in More Than 1.3 Million TV Set-Top Boxes across 200 Countries. PR Newswire. [Article Link]
- ONLINE NEWS The Tech Buzz Team. (2026, November 2). Google Bans Partner After 1.3M Android Boxes Turned Botnet. The Tech Buzz. [Article Link]
