Android TV set-top boxes from OEM Videostrong ship with a factory-installed backdoor (XCPE) that sold access for ad fraud, residential proxies and more malware; 1.3M+ devices (Google)

Google Threat Intelligence (2 Nov 2026) reports that Android OEM/ODM Videostrong Technology Co. deliberately preloaded the x.cpe backdoor (com.oemservice in some builds) in the firmware of many set-top box models and brands since at least late 2024. It runs with system privileges, reinstalls itself from the /oem/ partition after removal, turns off Google Play Protect, and takes commands over MQTT: silent app installs, shell commands as system, screenshots, keystroke injection, network reconnaissance and data theft. Operators also opened reverse shells. Videostrong sold access to affiliates whose modules (Linkfog, AppSalt, NetNut proxies; CBOXTV, HiddenView ad fraud; Moyu, Spirit backdoors) used the devices for ad fraud and as residential proxy exit nodes. Google and partners (Japan NPA, Lumen, HUMAN, Plume, Synthient, TrendAI) took down the C2 last week and cut off Videostrong. Google estimates 10M+ more devices were reached through the affiliates' other channels. The backdoor stays in the firmware of devices already sold. The full list of affected brands and models is unknown.

Summary written from the sources below. Check the originals before acting.