Google Disrupts 1.3M-Device XCPE Android TV Botnet and Bans Maker

Google and an international coalition of law enforcement and cybersecurity partners have dismantled the XCPE malware botnet—comprising more than 1.3 million Android TV streaming boxes infected at the factory—and permanently banned hardware manufacturer Videostrong Technology Co. from the certified Android ecosystem, according to BleepingComputer.

Takedown Cuts Off C2 Servers Linked to 1.3M XCPE Boxes and 10M Other Devices

Coordinated by Google's Threat Intelligence Group (GTIG) alongside Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI, the operation seized command-and-control (C2) domains (anyevonline[.]com) and an MQTT message broker (mqtt.szbboys[.]com):

• 12+ Malware Families Disrupted: In addition to severing control over the 1.3 million XCPE-infected Android TV boxes, taking down the shared C2 infrastructure cut off more than 12 related malware families operating across at least 10 million additional compromised retail set-top boxes, karaoke machines, and telehealth appliances.
• Persistent "/oem/" Firmware Backdoor & Residential Proxies: Embedded directly into the "/oem/" partition during manufacturing under the package names "x.cpe" and "com.oemservice" (and paired since late 2024 with loader "com.abc.nexus" before shifting in August 2026 to smaller droppers), the malware ran with Android system privileges, disabled Google Play Protect, and installed monetization plugins for residential proxy networks (Linkfog, AppSalt/Honeygain, GaGaNode, NetNut, and Traffmonetizer) as well as secondary backdoors (Moyu, Spirit, and Bird). Because the code resides in "/oem/", it reinstalls itself unless owners flash clean firmware or disconnect the device.

Synthient Traces MECOOL KM9PRO Max Backdoor to Videostrong R&D Director

In a companion technical disclosure, Synthient researchers explained that they discovered XCPE preinstalled on a MECOOL KM9PRO Max Android TV box purchased in late 2025. Investigators uncovered an open directory on "file.anyevonline[.]com" containing a PDF authored by Owen Cao, R&D director of Videostrong Technology Co., confirmed that "videostrong[.]cn" resolved to the same IP address as "mqtt.anyevonline[.]com", and matched Videostrong corporate email signatures on the malware binaries—prompting Google to revoke Videostrong's Android TV license and tighten post-boot certification testing.