A botnet hidden in the box
Google’s latest Android security action is not about a rogue app downloaded from a sketchy store. It is about devices that could arrive in a home already prepared to act as part of a criminal network. Google Threat Intelligence Group says it and industry partners dismantled the XCPE backdoor, which enrolled more than 1.3 million set-top boxes into a botnet, and assessed with high confidence that the backdoor and botnet were intentionally developed, deployed and operated for financial gain by Videostrong Technology Co., an Android OEM and ODM .
That attribution is what makes the episode especially consequential. In Google’s account, Videostrong did not merely ship devices that later became infected; the company allegedly monetized the backdoor by selling access to criminal affiliates and loading their malware modules onto infected devices . Google says those modules supported ad fraud, silent enrollment in residential proxy networks and the loading of additional malware .
The coordinated action also moved beyond the 1.3 million XCPE devices themselves. Google says it disrupted command-and-control domains used by affiliate modules and assesses that the takedown will cut access to at least 10 million additional compromised devices, because those affiliates also distributed their modules through channels outside XCPE . In other words, disabling XCPE hit one supply-chain implant and also damaged a larger cybercrime service layer around it.
Why XCPE was different from normal Android malware
Typical Android malware stories often begin with a malicious app, a sideloaded package or a phishing link. XCPE’s significance lies in its placement inside the device ecosystem. TrendAI Research says the affected boxes came with a pre-installed “x.cpe” management agent that used obfuscation to evade pre-release security tests and, once activated, could pull in unwanted software and enroll devices in residential proxy networks, ad-fraud networks, peer-to-peer content-delivery networks and other gray infrastructure without owner consent .
That means many victims would have seen an ordinary TV box that streamed content normally while, behind the scenes, it sold or abused their bandwidth. Plume, which says its telemetry helped surface the botnet, described the threat as invisible to ordinary subscribers: a set-top box could function perfectly and still generate unexplained traffic, expose subscriber information and undermine trust in a broadband service .
The technical design gave the operators broad control. BleepingComputer reports that the main backdoor components, tracked as x.cpe and com.oemservice, ran with Android system-level privileges, contacted command infrastructure for MQTT broker credentials, and allowed operators to deploy additional malware or perform actions such as silent app installation, shell command execution, screenshot capture, keystroke injection, account and device data collection, network reconnaissance and reverse shells .
That is why the “certified device” angle matters. Certification normally signals a baseline of compatibility and security review. Yet the XCPE case shows that a device can appear trusted on paper while later activating code paths that turn it into a remotely managed botnet node. Google says it found the malicious software built directly into many device models and brands over multiple years, supported by dedicated infrastructure and evolving configurations designed to evade detection .
The money machine: proxies, ads and pay-per-install
XCPE’s operators did not need to brick devices or display ransom notes to make money. The business model was quieter. TrendAI observed that the fleet was managed through the x.cpe agent and a monetization module known as com.abc.nexus, which could pull payloads that enrolled devices in pay-per-bandwidth services such as Traffmonetizer, Grass and Honeygain . TrendAI says the operation turned set-top boxes into residential proxy exit nodes, ad-fraud clickers or nodes within peer-to-peer content-delivery networks, making money while owners remained unaware .
The scale was large enough to matter to fraud teams and online services. TrendAI says its telemetry, measured between June and October 2026, counted 1,472,554 infected devices across 206 models in more than 170 countries, with about 1.33 million scheduled for proxy and ad-fraud modules . It also reported more than 3.8 million distinct residential exit IP addresses over four months, including daily availability averaging roughly 182,000 residential IPs and peaking above 366,000 .
Residential proxies are valuable because they make automated or criminal traffic look like it is coming from real households. A login attempt, scraping request or ad interaction from a home broadband address can pass checks that would block a datacenter VPN or a known bot host. That makes a compromised TV box more than a nuisance: it becomes a reusable disguise for credential stuffing, ad fraud, scraping and other abuse.
The takedown and the ban
The response combined network, legal and ecosystem measures. Plume says Google’s actions included legal action to take down domains and servers used to control the X.CPE botnet, legal action against control domains of more than a dozen malware families loaded through it, a ban on the responsible manufacturer from building and selling certified Android devices, and changes intended to protect certified firmware integrity .
Trend Micro’s coordinated announcement lists Google, Plume, TrendAI, Lumen, HUMAN Security, Synthient and Japan’s National Police Agency as participants in the effort to identify and disrupt X.CPE across more than 200 countries . The same announcement says the botnet was hidden on devices before sale, used subscribers’ devices and home internet connections without consent, and gave controllers remote access to exploit broadband resources .
Google’s supplier response is unusually blunt. It says it cut ties with Videostrong and banned the company from making devices with preloaded Google apps after concluding the campaign was not a rogue insider or development oversight . TrendAI adds that Google permanently banned the company, along with future subsidiaries or affiliates, from building and selling certified Android devices or supplying software to other certified vendors .
What researchers say tied it to Videostrong
Synthient’s companion research gives more detail on attribution. Its team says it analyzed MECOOL devices, found a pre-installed backdoor running as com.oemservice, and traced the campaign to Videostrong Technology Co., Ltd. . Synthient says it found C2 infrastructure overlaps, a publicly accessible directory containing backdoors and a signed document by a Videostrong R&D director, as well as Videostrong email addresses used to sign backdoors .
Synthient also says its research uncovered more than 1.3 million compromised devices operating as part of a broader pay-per-install campaign, and it recommended that affected devices be pulled from online marketplaces and that consumers dispose of them because of the risk of additional malware . That is a stronger recommendation than “reset the box,” because several reports emphasize that the implant lives at a privileged system level.
BleepingComputer reports that, although the takedown disrupted XCPE operations, the malware was not removed from already infected devices and can reinstall itself from the /oem/ partition if deleted . That leaves owners in a difficult position: if clean firmware is unavailable, disconnecting or replacing the device may be the safer practical answer.
The Android ecosystem lesson
The XCPE case exposes a stubborn weakness in the cheap connected-device market. Many households and small businesses buy inexpensive streaming boxes, projectors or smart displays because they work and are cheap. But if the firmware supply chain is compromised, the owner may have no visible warning and no realistic way to repair the device.
For Android, the lesson is not simply that malware exists. It is that trust has to be maintained after certification, across OEMs, ODMs, white-label brands, firmware updates and post-boot activation flows. Google says it has changed its review process in response to the techniques used to evade testing . That matters, because the next botnet does not need to call itself XCPE to reuse the same economic logic: sell millions of inexpensive devices, quietly monetize their bandwidth and keep the customer watching TV while the box auditions for Skynet.
For users, the practical advice is less glamorous but urgent. Avoid unbranded or suspiciously cheap Android TV boxes, especially devices marketed around sideloading or piracy. Put IoT gear on a separate network where possible. Watch for unexplained bandwidth use. And if a device is named in credible XCPE or BadBox-style reports, treat it not as a quirky gadget but as potentially hostile hardware.
The takedown is a win for Google and its partners, but it is also a warning. A botnet no longer has to break into your living room. Sometimes it arrives shrink-wrapped, plugs into HDMI and works just well enough that nobody asks what else it is doing.
Comments
Be the first to comment.