Google disrupts million-device XCPE Android malware botnet, bans TV box maker

What it is

XCPE is a firmware-level Android backdoor on more than 1.3 million TV boxes. Google's Threat Intelligence Group (GTIG) attributes it with high confidence to Videostrong Technology Co, which it says built, deployed and operated it for profit. Synthient found it preinstalled on a MECOOL KM9PRO Max box bought in late 2025. Google also took down C2 servers used by more than a dozen related malware families, covering at least 10 million further devices. Those were infected by other means and include set-top boxes, karaoke machines and telehealth hardware, not all of them Android.

How it works

The main components, x.cpe and com.oemservice, run with Android system privileges. At boot the device contacts a server on anyevonline[.]com (subdomain varies by Android version and device type) to get MQTT broker credentials. The broker was mqtt.szbboys[.]com. Through it, operators can:

• install apps silently and disable Google Play Protect
• run shell commands and scripts as system
• take screenshots and inject keystrokes
• collect account details, app lists and system logs
• run network reconnaissance and open reverse shells

Revenue modules are separate from the backdoor. They include residential proxy clients (Linkfog, AppSalt/Honeygain, GaGaNode, NetNut, Traffmonetizer), ad fraud modules, and other backdoors (Moyu, Spirit, Bird). In late 2024 a separate loader, com.abc.nexus, took over running modules while XCPE handled C2 traffic. The page says that from August 2026 the operators began replacing it with small droppers disguised as Android system apps.

Synthient's attribution rests on an open directory on file.anyevonline[.]com holding backdoors and a PDF by Videostrong's R&D director. It also found videostrong[.]cn resolving to the same IP as mqtt.anyevonline[.]com, and backdoors signed with Videostrong email addresses.

Preconditions / Affected

Exposure comes from the hardware, not user action. The infection shipped across multiple brands and models over several years. The page names only the MECOOL KM9PRO Max and gives no full model list.

What to do

• Treat any suspect Android TV box as compromised. The page says the only fixes are installing clean firmware or disconnecting the device from the internet.
• Removing the malware is not enough: it reinstalls itself from the /oem/ partition.
• Hunt for DNS or network traffic to anyevonline[.]com (including mqtt and file subdomains), mqtt.szbboys[.]com and videostrong[.]cn.
• Look for the package names x.cpe, com.oemservice and com.abc.nexus on devices.
• Check for residential proxy clients you did not install.

Caveats

• The takedown disrupted operations but did not clean infected devices.
• Google says not all of the 10 million additional devices are Android and that they were compromised by other means than XCPE.
• BleepingComputer had asked Google further questions and had no reply when the article was published.
• The page gives no hashes, device list or firmware versions, so identifying affected units depends on network indicators.