Google says it has disrupted the XCPE botnet, a network spanning more than 1.3 million infected TV boxes. The operation is notable because the company attributes the malware’s distribution to Videostrong Technology, a Chinese device manufacturer that Google says intentionally developed and preinstalled the backdoor before products reached users.
According to Google, Videostrong then sold access to compromised devices to partners involved in criminal activity. Some affected products were certified Android TV devices, meaning they had passed Google’s certification process despite the presence of the malicious component. Google says it has high confidence in its attribution.
XCPE functioned as a backdoor, allowing operators to send commands to a device and install further components remotely. Owners could continue using a box for streaming while its internet connection and system resources were used in the background.
- Advertising fraud through activity associated with ads.
- Residential proxy services that routed third-party traffic through a device owner’s home internet connection.
- Deployment of additional malware on compromised devices.
Researchers also observed commands capable of taking screenshots, injecting keystrokes and extracting data including account information. That does not mean every device in the reported 1.3 million-plus total was used for each of those activities.
Certification did not prevent the compromise
Videostrong was an Android TV partner, but Google says the code used concealment techniques and downloaded malicious components after a device’s first startup. The company says it has changed its vetting process following the discovery. The incident shows that Android TV certification remains a meaningful security signal, but is not an absolute guarantee against supply-chain compromise.
Google has ended its relationship with Videostrong and barred it from producing certified Android devices or providing software to other certified manufacturers. Google and its partners also disrupted infrastructure used to control the botnet.
Security researchers at Synthient examined a MECOOL KM9PRO Max acquired for their investigation and found XCPE preinstalled. Because Videostrong manufactured products under multiple names, branding on a TV box may not identify the underlying manufacturer.
Shutting down command-and-control servers does not automatically remove XCPE from affected hardware. Google says the malware is embedded in the system and can reinstall itself after removal. Synthient recommends taking confirmed infected devices out of service; a standard factory reset should not be treated as a reliable fix. The remaining question is how broadly the compromised software reached other models and brands supplied through the same manufacturing chain.
