Certified Android TV maker Videostrong backdoored its own devices, criminals monetized 1.3M devices

Videostrong, a certified Android device maker in China, deliberately infected more than 1.3 million set-top boxes, including popular Mecool models, and sold access to criminals running ad fraud and proxy networks. Google and industry partners took down its botnet, known as XCPE, and banned the company.

Google said it has dismantled a massive botnet, dubbed XCPE, and has banned its operator, Videostrong Technology, an Android original equipment manufacturer (OEM) behind Mecool and other brands, headquartered in Shenzhen, China.

Google's threat intelligence team has “high confidence” that Videostrong built a backdoor over years and intentionally deployed it across more than 1.3 million set-top boxes.

“Videostrong monetized the backdoor by selling access to criminal affiliates and loading those affiliates’ malware modules onto infected devices,” the Google Threat Intelligence team said in a new report.

Infected TV boxes, without owners’ knowledge, were involved in ad fraud and residential proxy networks and were loaded with additional malware.

Synthient, a security firm, analyzed a Mecool KM9PRO Max TV box from last year and found the malware already installed. It also flagged an additional roughly 180 device model names included in the campaign, and called the 1.3 million figure conservative.

The researchers noted that the Mecool brand has been featured by prominent YouTubers, including Linus Tech Tips.

“These devices have gained popularity in the consumer market, especially for piracy, allowing users to install third-party apps to circumvent DRM,” Sentient said.

Cheap off-brand TV boxes have long been a known source of preinstalled malware, and Google has been repeatedly warning that millions of uncertified Android devices comprise massive botnets.

However, Videostrong sold Google-certified devices, a status that requires manufacturers to demonstrate compatibility and pass security tests designed to ensure a safe user experience.

The ban bars Videostrong and any of its future subsidiaries or affiliates from making certified Android devices or supplying software to other certified vendors.

Massive hit to botnets: 10 million compromised devices severed

Google says its action disrupted the command-and-control (C2) domains that power various malware modules loaded both on XCPE and other compromised devices.

Each affiliate runs independent distribution channels that expand well beyond XCPE.

We assess that taking down their C2 domains will sever access to at least 10 million additional compromised devices,

Google said in the report.

Google listed 168 network resources, including IPs, domains, and subdomains, such as GitHub repos, associated with the campaign, as well as 22 affiliate malware variants.

The backdoor reinstalls itself even when users remove it

The XCPE malware has been under active development since at least 2024. The ongoing operation was built for profit, and, over time, Videostrong developed a three-stage architecture for resilience and multi-tenant monetization.

The rogue firm reportedly used obfuscation techniques to bypass Google’s security tests and load malware after the device’s first boot.

The primary backdoor has system-level privileges and is preloaded in the firmware partition – even if users uninstall the component, it automatically reinstalls upon reboot, maintaining persistent access.

The XCPE’s main job is to communicate with C2 servers – execution is offloaded to other malware. Videostrong first used a loader called ABCNexus to run module execution, then replaced it with smaller tailored droppers.

“Videostrong monetizes its backdoored devices by loading monetization modules which are developed by entities other than Videostrong that act as affiliates,” Google explained.

The devices should be treated as completely compromised.

Infected devices were found running residential proxy exit nodes such as Linkfog, AppSalt, NetNut, and ad-fraud engines (CBOXTV, HiddenView), or executing additional backdoors and additional monetization modules (e.g., Moyu, Spirit).

One of the dozens of malicious modules, HiddenView, runs in the background, uses a transparent window overlay, loads targeted web pages, and simulates user interactions such as scrolling, clicking, typing while playing media, and capturing the user’s screen, all unattended.

The botnet is globally dispersed

According to Synthient, the strongest presence of XCPE is in Malaysia, Mexico, and Brazil, but many victims are also in the United States, China, and Germany. Fewer than half of the devices in a botnet, around 500,000, are active daily.

The overwhelming majority of the infected devices are Android TV set-top boxes, but not all of them.

“We observed a number of other infected Android-based IoT devices, including telehealth devices, karaoke machines, and digital signage devices,” Google added.

Google believes that the evolution of XCPE malware was likely accelerated by earlier actions against BadBox, another major botnet running on TV boxes. Several of the malicious modules were previously tied to BadBox enterprise.

The malicious activity is unlikely to stop

Google said it took legal action against the domains and servers operated by Videostrong as well as a dozen other malware families. It also implemented additional changes to its review process to better ensure the integrity of firmware and certified Android TV devices.

“While we believe our actions have seriously impacted over a dozen malicious actors, the underlying illicit market is resilient,” the tech company warns.

“Backdoor operators, ad-fraud rings, and residential proxy providers operate as an interconnected supply chain, and when one component is disrupted, operators quickly pivot to new loaders or rival monetization SDKs.”

Google calls for greater accountability across the hardware supply chain, urging retailers, distributors, telecommunications providers, and others to require independent security audits by Original Design Manufacturers (ODMs).

Android TV website provides the most up-to-date list of Google’s partners – users should avoid purchasing connected devices from unreliable manufacturers.

Google also alerts users to apps that offer payment in exchange for unused bandwidth or sharing the internet.

“Stick to app stores you trust, review permissions for third-party VPNs and proxies, and ensure built-in security protections like Google Play Protect are active,” Google said.

What to do if you own an affected device?

Synthient recommends that users immediately and permanently dispose of affected devices, as they pose a high risk of additional malware and can access devices on the network.

Organizations are urged to block the full list of Indicators of Compromise, shared in a public research repository.

Retailers and marketplaces are also urged to remove the devices from their listings.

The security firm deployed a synthient.com/check tool that lets users confirm their IPs aren’t being misused as residential proxies.

In the event of a compromise, the firm also recommends changing WiFi passwords and updating router and device firmware.