XCPE Botnet: Videostrong Android TV set-top boxes — OEM preinstalled backdoor enrolled 1.3M+ devices in botnet (no CVE)
Severity: high · Patch status: unpatched · Since 2026-11-02
Google Threat Intelligence Group, working with Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI, disrupted the XCPE backdoor and the botnet it built. Google says it assesses with high confidence that Videostrong Technology Co., an Android OEM/ODM, built, deployed and ran the backdoor for financial gain, and that it has been in the firmware since at least late 2024. The backdoor (x.cpe, also seen as com.oemservice) is preloaded at system privilege, reinstalls itself from the /oem/ partition after a user uninstalls it, and takes commands over HTTP and MQTT. Videostrong sold access to criminal affiliates, whose modules run ad fraud, residential proxy services (Linkfog, AppSalt, NetNut) and further malware. Google reports more than 1.3 million set-top boxes enrolled and assesses that taking down the affiliate C2 domains cuts off at least 10 million more devices. The infected devices span many device models and brands, not only Videostrong-made boxes, and also include telehealth devices, karaoke machines and digital signage. Google has banned Videostrong from building certified Android devices, is improving firmware-integrity checks for certified Android TV devices, and publishes no removal procedure for devices already infected.
What to do
- Search device fleets for com.oemservice, x.cpe, com.abc.nexus and the newer dropper packages com.android.system.ntp and com.android.sso.auth.handler, which Google reports on the botnet since August 2026
- Treat any device carrying these packages as compromised and isolate or replace it; Google publishes no removal procedure, and the stub reinstalls from the /oem/ partition after uninstall
- Block the C2 and staging hosts Google names: mqtt.szbboys[.]com, ott.szbboys[.]com, mcstb.anyevonline[.]com and stb*.anyevonline[.]com
- Check guest and IoT networks for residential-proxy or ad-fraud traffic from the Linkfog, AppSalt, NetNut, CBOXTV or HiddenView modules, and for devices where Google Play Protect verification has been switched off (package_verifier_user_consent set to -1)
Sources
All live incidents on Threat Watch
