Google Threat Intelligence Group and a coalition of partners have disrupted XCPE, a botnet of more than 1.3 million Android set-top boxes in over 200 countries, and cut ties with Shenzhen-based manufacturer Videostrong Technology Co., which Google says planted the backdoor at the factory.
Google Says Videostrong Built the XCPE Backdoor Into Its Firmware
GTIG assessed with high confidence that Videostrong deliberately embedded the XCPE backdoor in device firmware during manufacturing and then sold access to criminal affiliates. The malware appeared across many device models and brands over multiple years, which means buyers had no way to tell an infected box from a clean one at the point of sale.
The backdoor, tracked as x.cpe and com.oemservice, runs with Android system-level privileges. According to the GTIG report, it retrieves MQTT broker credentials from a command-and-control domain, anyevonline[.]com. The broker at mqtt.szbboys[.]com then let operators install and remove apps, change device settings and push updates. TrendAI, one of the partners in the operation, said the firmware agent posed as a standard remote-management client and pulled its updates from a GitHub page.
How Affiliates Monetized the Compromised Boxes
Affiliates who bought access used the devices for ad fraud, residential proxy services and additional malware modules. The GTIG report names several proxy software development kits tied to the activity, including AppSalt/Honeygain, NetNut, GaGaNode, Traffmonetizer, EarnFM, Jaguar, LINKFOG and BMW/IPWeb. Each turned the home internet connections of unsuspecting owners into exit nodes that other customers could route traffic through.
Between June 3 and October 1, TrendAI documented more than 3.8 million distinct home and mobile IP addresses connected to the operation. That figure is larger than the 1.3 million boxes in the botnet because proxy traffic cycles across many addresses and devices over time.
Scale Beyond the 1.3 Million Android Set-Top Boxes
Google expects the takedown of the affiliates’ command-and-control domains to cut access to at least 10 million additional compromised devices. Those include set-top boxes, karaoke machines, telehealth hardware and digital signage, and not all of them run Android. The spread into commercial gear means the exposure reached beyond living rooms into clinics and storefronts.
Takedown Combined Legal Action and Platform Bans
Domains and servers were taken down under legal action, and Google published its report on Monday. The participants were Google, Lumen, HUMAN Security, Plume, Synthient and TrendAI, working with Japan’s National Police Agency.
Google also moved against the manufacturer directly. Videostrong is banned from producing certified Android devices and has lost access to preloaded Google apps and services. It is also barred from supplying software to certified vendors, a restriction that extends to its future affiliates. Google said it has addressed the first-boot weakness that allowed the preloaded malware to install.
Videostrong did not respond to requests for comment on the takedown. Oxylabs, the owner of Honeygain, also did not respond to requests for comment.
Link to the Earlier BadBox 2.0 Disruption
Reporting on the takedown noted that the operation belongs to the same ecosystem as BadBox 2.0, a botnet disrupted in March 2025. The repetition is notable: two large takedowns within roughly a year have both involved low-cost Android devices that shipped with malware already installed, rather than devices infected after purchase.
Why Preinstalled Malware Is Hard for Buyers to Detect
The XCPE case follows a pattern that has made consumer IoT hardware an attractive resource for proxy and fraud operators. A device compromised at the firmware level gives its operator system-level control, so owners cannot remove the malware by reinstalling apps. Because the backdoor posed as a legitimate remote-management client, ordinary inspection of the device would not necessarily reveal it.
The commercial incentive is also visible in the report. Residential proxy services sell access to traffic that appears to come from ordinary households, which makes it valuable for ad fraud and for masking other criminal activity. A manufacturer that controls the firmware can supply that traffic at scale and at scale, which is why Google’s enforcement focused on the manufacturer rather than only the affiliates.
Whether the bans on Videostrong will hold is an open question. The company is barred from future certified Android products, but uncertified devices can still be sold, and the cut-off from Google services does nothing for the roughly 1.3 million boxes already in homes. Google’s statement about addressing the first-boot weakness covers the installation route for new devices, while owners of existing units are left to rely on the takedown of the control servers to stop the traffic.
