{"id":"CMP-202611-totfl5","kind":"campaign","aliases":[],"related":[],"title":"Android TV set-top boxes from OEM Videostrong ship with a factory-installed backdoor (XCPE) that sold access for ad fraud, residential proxies and more malware; 1.3M+ devices (Google)","description":null,"summary":"Google Threat Intelligence (2 Nov 2026) reports that Android OEM/ODM Videostrong Technology Co. deliberately preloaded the x.cpe backdoor (com.oemservice in some builds) in the firmware of many set-top box models and brands since at least late 2024. It runs with system privileges, reinstalls itself from the /oem/ partition after removal, turns off Google Play Protect, and takes commands over MQTT: silent app installs, shell commands as system, screenshots, keystroke injection, network reconnaissance and data theft. Operators also opened reverse shells. Videostrong sold access to affiliates whose modules (Linkfog, AppSalt, NetNut proxies; CBOXTV, HiddenView ad fraud; Moyu, Spirit backdoors) used the devices for ad fraud and as residential proxy exit nodes. Google and partners (Japan NPA, Lumen, HUMAN, Plume, Synthient, TrendAI) took down the C2 last week and cut off Videostrong. Google estimates 10M+ more devices were reached through the affiliates' other channels. The backdoor stays in the firmware of devices already sold. The full list of affected brands and models is unknown.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-02T13:42:02+00:00","products":[{"name":"Videostrong Android TV set-top boxes","fixed":[],"vendor":"Videostrong Technology Co."}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Look for Android TV boxes or set-top boxes on office or home-office networks (Videostrong-made; builds with the ro.mecool.device property or YokaTV Player) that have the packages x.cpe, com.oemservice or com.abc.nexus. In DNS, proxy or firewall logs, look for traffic to *.anyevonline.com:8000 (e.g. mcstb.anyevonline.com, stb*.anyevonline.com), mqtt.szbboys[.]com or ott.szbboys[.]com, or MQTT traffic leaving these devices. Also look for corporate IPs listed as residential proxy exit nodes.","fix":"Take Videostrong-made or uncertified Android TV boxes off corporate and production networks and replace them. A factory reset does not help, because the backdoor is in the firmware. If a box must stay, put it on an isolated VLAN that has no route to internal systems. Block anyevonline.com and szbboys.com at DNS and the egress proxy. Check for unexpected outbound proxy traffic from those network segments.","status":"open","published_at":null,"first_seen_at":"2026-11-02T13:42:02+00:00","triaged_at":"2026-11-02T13:42:02+00:00","updated_at":"2026-11-02T13:42:02+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202611':34A '/oem':99B '1.3':29A '10m':185B '2':54B '2024':89B '2026':56B 'access':20A,135B 'ad':22A,146B,155B 'affect':209B 'affili':137B,192B 'alreadi':203B 'also':129B 'android':1A,41A,59B 'app':114B 'appsalt':141B 'backdoor':16A,39A,68B,150B,196B 'box':6A,81B 'boxes':46A 'brand':84B,210B 'build':72B 'c2':176B 'campaign':47B 'cboxtv':144B 'channel':194B 'cmp':33A 'co':63B 'com.oemservice':69B 'command':110B,117B 'cut':180B 'data':126B 'deliber':64B 'devic':31A,153B,187B,202B 'earli':49B 'early-warn':48B 'estim':184B 'exit':161B 'factori':14A 'factory-instal':13A 'firmwar':75B,200B 'fraud':23A,147B,156B 'full':206B 'googl':32A,51B,105B,163B,183B 'hiddenview':145B 'human':169B 'inject':122B 'instal':15A,115B 'intellig':53B 'japan':166B 'keystrok':121B 'last':177B 'late':88B 'least':87B 'linkfog':140B 'list':207B 'lumen':168B 'm':30A 'malwar':28A 'mani':77B 'model':82B,212B 'modul':139B 'moyu':148B 'mqtt':112B 'netnut':142B 'network':123B 'node':162B 'nov':55B 'npa':167B 'oem':8A 'oem/odm':60B 'open':130B 'oper':128B 'partit':100B 'partner':165B 'play':106B 'plume':170B 'preload':65B 'privileg':94B 'protect':107B 'proxi':25A,143B,160B 'reach':189B 'reconnaiss':124B 'reinstal':95B 'remov':102B 'report':57B 'residenti':24A,159B 'revers':131B 'run':91B 'screenshot':120B 'set':4A,44A,79B 'set-top':3A,43A,78B 'shell':116B,132B 'ship':10A 'silent':113B 'sinc':85B 'sold':19A,134B,204B 'spirit':149B 'stay':197B 'synthient':171B 'system':93B,119B 'take':109B 'technolog':62B 'theft':127B 'threat':52B 'took':173B 'top':5A,45A,80B 'totfl5':35A 'trendai':172B 'turn':103B 'tv':2A,42A 'unknown':214B 'use':151B 'videostrong':9A,38A,40A,61B,133B,182B 'warn':50B 'week':178B 'whose':138B 'x.cpe':37A,67B 'xcpe':17A,36A","nicknames":["XCPE","x.cpe","Videostrong backdoor"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["androidtvsettopboxes","videostrongandroidtvsettopboxes","videostrongbackdoor","xcpe"],"ptokens":["android","boxes","set","top","tv","videostrong"],"labels":["campaign","earlywarning","high","vendor"],"first_public_at":"2026-11-02T14:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-totfl5","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-02T13:42:02+00:00","fetched_at":"2026-11-02T13:42:02+00:00","note":null}],"documents":[{"id":52001,"url":"https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet/","title":"Google Threat Intelligence: Shutting the Door on the XCPE Botnet","kind":"blog","source":"blog","publisher":null,"text":"Shutting the Door on the XCPE Botnet\n\nWritten by: Charley Snyder Introduction Last week, Google and industry partners dismantled the XCPE backdoor which enrolled more than 1.3 million set-top boxes into a botnet. We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co., an Android Original Equipment Manufacturer (OEM) and Original Device Manufacturer (ODM). Videostrong monetized the backdoor by selling access to criminal affiliates and loading those affiliates’ malware modules onto infected devices. These secondary modules were conducting ad-fraud; silently enrolling infected devices into residential proxy networks; and loading additional malware onto XCPE-compromised devices. We also took action to disrupt the command and control (C2) domains that operate these affiliate modules. Because these affiliates each have diversified distribution channels for their modules beyond XCPE, we assess that taking down their C2 domains will sever access to at least 10 million additional compromised devices. We found this malicious software built directly into many different device models and brands over multiple years, supported by dedicated infrastructure and constantly evolving configurations to evade detection and manage their affiliates. We believe this campaign wasn’t an isolated rogue insider or a development oversight. As a result, Google has cut ties with Videostrong and banned them from making devices with preloaded Google apps. Google requires OEMs go through a comprehensive suite of compatibility and security tests to ensure a consistent and safe user experience across the Android ecosystem. However, Videostrong employed obfuscation techniques to exploit a gap in our tests and load malicious code after the device's first boot. As a result, Google has implemented changes to its existing review process to better safeguard against similar activity in the future. A device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust, and represents a serious risk to those users. Without users’ knowledge or consent, infected devices were offered as a distribution mechanism for a wide array of criminal actors. This led to a variety of malicious activities being conducted on and through the devices, including ad-fraud, data exfiltration, and routing malicious network traffic through the devices. We worked closely with Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI to analyze this malware ecosystem and disrupt its operations. While we expect this disruption to have a significant effect on these criminal operations, this is not the end of our work combatting malicious activity. Backdoor operators, ad-fraud rings, and residential proxy providers operate as an interconnected supply chain. Point-in-time disruptions are a critical tool to protect our users, but lasting disruption in this fluid ecosystem will require continued targeting of this infrastructure. Google undertook the following actions to support disruption of the XCPE botnet: Legal action to take down the domains and servers Videostrong used to control the botnet and install malware modules Legal action to take down C2 domains used by over a dozen malware families loaded as modules via this backdoor Banned Videostrong and any future subsidiaries or affiliates from building and selling certified Android devices in the future, or supplying software to other certified vendors Implementing improvements to how we ensure the integrity of firmware on certified Android TV devices Overview The x.cpe network was built for ongoing profit. By giving malware affiliates backdoor access, the operators conspired to monetize these devices long after purchase. Figure 1: XCPE malware overview Malware Since at least late 2024, Videostrong has evolved its pre-installed malware from simple single-stage droppers into a modular, three-stage architecture designed for","published_at":"2026-11-02T14:00:00+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}