Google’s Threat Intelligence Group disrupted XCPE, a botnet built predominantly from Android TV set-top boxes, and attributed the operation with high confidence to Videostrong Technology Co., a Chinese Android original-equipment manufacturer. Google alleges the company intentionally embedded the backdoor into firmware and enabled criminal affiliates to monetize secretly tracking users for financial gain. The operation reached more than 1.3 million devices across more than 200 countries.
The Permanent Ban
Google’s response went further than a takedown notice.
Google permanently banned Videostrong, including any future subsidiaries and affiliates, from manufacturing certified Android devices or supplying software to other certified vendors. That ban closes off the Android certification ecosystem to the company across its future product lines.
Delete the App, the Malware Stays
The malware was not something a user could simply uninstall.
The backdoor appeared under package names x.cpe and com.oemservice, operating with Android system-level privileges. A firmware component could reinstall it automatically after a reboot, making ordinary removal ineffective against the persistent firmware component. The malware then maintained a persistent connection over MQTT, a lightweight device-messaging protocol, to receive commands and configuration updates from operator infrastructure.
What Operators Could Do Once Inside
The access was broad enough to treat a compromised device as the operators’ own.
The malware could silently install applications, capture screenshots, inject keystrokes, and collect account and device information. Operators could also establish reverse shells, giving them direct command-line access to the compromised device. Google said the malware could disable Google Play Protect’s app-verification function, and that Videostrong allegedly delayed loading malicious code until after first boot to evade pre-release certification checks. A surveillance app targeting activists followed similar covert installation patterns.
Your Home Network as a Revenue Stream
Infected devices were enrolled into services that sold victims’ internet connections to outside customers.
XCPE enrolled devices into residential proxy networks, generated fraudulent advertising traffic, and distributed additional malware through affiliate modules. Residential proxies work by routing outside customers’ traffic through other people’s home connections. That makes abusive or fraudulent activity appear to originate from ordinary households. Google identified modules associated with Linkfog, AppSalt/Honeygain, NetNut, and Traffmonetizer; researchers found that some devices ran as many as three proxy software kits simultaneously.
MECOOL Devices, Named
Researchers traced the infrastructure back to recognizable consumer products.
Synthient analyzed a MECOOL KM9PRO Max and linked its backend infrastructure to Videostrong. The connection ran through server records, signing email addresses, and a document tied to the company’s R&D director. The investigation also connected the campaign to the YOKATV storefront, and Synthient estimated that roughly 500,000 devices were actively online at the time, with concentrations in Malaysia, Mexico, and Brazil.
A Coordinated Disruption, Not a Full Cleanup
“Disrupted” is not the same word as “fixed.”
The coordinated action involved Google, Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI. Google estimates that disrupting affiliate infrastructure may sever operator access to at least 10 million additional compromised devices reached through distribution channels beyond XCPE. That figure reflects disrupted control, not confirmed disinfection of hardware already in consumers’ homes.
What to Do If You Own One
Retiring the hardware is not an overreaction.
Owners of affected devices should disconnect them from the internet. Synthient recommends replacing the hardware entirely, because additional malware may persist at the firmware level even after the botnet’s command infrastructure is gone. Google advises buying connected devices from reputable manufacturers and keeping built-in security protections enabled. For broader home security, consider switching to devices from verified vendors, and review our guide on how to stay safe from hardware-level threats.
