What we know so far: Google has severed ties with Android TV box maker Videostrong Technology over allegations that the company pre-installed a backdoor on more than 1.3 million set-top boxes. The backdoor, dubbed XCPE, reportedly used “obfuscation techniques” to bypass Google’s verification process and registered infected devices in a massive botnet that has since been shut down by the search giant.
The backdoor was discovered in the firmware of several Videostrong devices such as the Mecool KTI as well as several white label Android TV boxes. Seattle-based cybersecurity and fraud intelligence research group Synthient, which worked with Google to analyze the malware, says it has identified at least 182 different device models that were infected with the backdoor and registered in the botnet.
The malware reportedly exploited a firmware vulnerability in Android devices to load malicious code after the devices were booted for the first time. The malware was first deployed in 2024 as a simple, single-tier dropper and was rebuilt by Videostrong over the next few years with a modular, three-tier architecture, making it more resilient and enabling multi-tenant monetization.
In addition to Android set-top boxes, the malware was also discovered in several other Videostrong products, including telemedicine devices, karaoke machines and digital signage. The backdoor used various obfuscation techniques to bypass Google’s certification tests and disabled Play Protect, Google’s security tool that provides real-time malware protection on Android devices.
According to Google’s Threat Intelligence Group, the infected devices were integrated into a global botnet that allowed criminals to commit ad fraud, steal data, capture screenshots, inject keystrokes and open remote shells. The compromised devices were also registered on proxy networks to route unauthorized traffic to the command-and-control servers operated by the criminals.
Explaining Videostrong’s role in the spread of the The company added that the backdoor is designed to evolve over its lifespan, changing its properties to evade detection as more devices are added to a rapidly growing botnet.
The Shenzhen-based OEM reportedly monetized the backdoor by allowing cybercrime syndicates to load their own malware modules onto infected devices. These secondary modules are designed not only to commit ad fraud and register compromised devices on private proxy networks, but also to install additional malware.
To analyze the XCPE ecosystem and disrupt the command-and-control domains used by botnet operators and their partners, Google worked closely with several international law enforcement agencies and cybersecurity firms, including Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI.
It’s worth noting that Google estimates the total number of affected devices to be around 1.3 million, but TrendMicro says it has counted a total of 1,472,554 infected devices in the US, Canada, Germany, UK, Australia, Brazil, Malaysia, Iraq, Mexico and Taiwan.
Google says it has taken several steps to prevent similar incidents from happening again, including banning Videostrong and its subsidiaries from manufacturing certified Android devices or supplying software to other Android vendors and Google partners. The company is also improving its certified Android program to ensure firmware integrity.
