Skip to content
NewA calmer, faster ZeroHour
StoryMalwarehighExploited in the wild

Google disrupts Videostrong XCPE botnet on Android TV boxes

1 source · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Google and partners disrupted Videostrong’s XCPE firmware backdoor on more than 1.3 million Android TV boxes used as proxies.

Google, Japan’s National Police Agency, and security partners disrupted the XCPE botnet, also called x.cpe or X.CPE, that Videostrong Technology built into Android TV set-top boxes. The firmware backdoor runs with system privileges, can reinstall from the OEM partition, and was used to sell access for residential proxies, ad fraud, and extra malware. Most outlets report more than 1.3 million enrolled devices; Ars Technica says Trend Micro counted 1.47 million and that domain seizures cut off 10 million devices. Google took legal action against control domains and servers and banned Videostrong from Google-certified devices. Malwarebytes says the takedown disrupted the botnet but the backdoor remains in infected firmware.

Key facts
  • Backdoor x.cpe, or com.oemservice, runs with system privileges
  • Removed copies reinstall from the /oem/ partition on reboot
  • Modules use MQTT and GitHub; kits include AppSalt and Linkfog
  • Google banned Videostrong from devices with preinstalled Google apps
  • The Record: devices in more than 200 countries; malware updated in 2024 and 2026
  • Ars Technica: Play Protect remains disabled on infected MECOOL boxes
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

What each outlet adds

beyond the shared facts
  • Security AffairsMQTT command and control, GitHub modules, AppSalt and Linkfog kits
  • Malwarebytes LabsBackdoor remains in firmware after the botnet disruption
  • Ars TechnicaTrend Micro’s 1.47 million count, 10 million claim, MECOOL Play Protect
  • The RecordMore than 200 countries and malware updates in 2024 and 2026
  • Dark ReadingNovember 4 report that partners disrupted the control infrastructure
Vendors
GoogleTrendAIHumanSynthientVideostrong Technology Co.VideostrongTrend MicroVideostrong Technology
Products
Android devicesAndroid TV boxesMECOOLAndroid TV set-top boxes
Threat actors
VideostrongVideostrong Technology
Malware
XCPEcom.abc.nexuscom.oemservicex.cpe network
Victims
users of Android TV boxesend users of set-top boxes
Organizations
GoogleGoogle Threat Intelligence GroupNational Police Agency
Countries
JapanChinaBrazilMalaysiaIraqMexicoTaiwan

Coverage

oldest first · one row per article · UTC
  1. · 8d ago Security AffairsFirst report

    Google Dismantles 1.3 Million Device XCPE Botnet Built by Videostrong

    Videostrong built and operated XCPE backdoor in Android TV set-top boxes for ad fraud and proxy abuse, affecting over 1.3 million devices.

  2. · 8d ago Security Affairs

    Google dismantles 1.3M-device XCPE botnet operated by Videostrong

    Videostrong developed XCPE backdoor in 1.3M Android TV boxes for proxy abuse and ad fraud, now banned from Google ecosystem.