---
id: "CMP-202611-totfl5"
kind: "campaign"
aliases: []
title: "Android TV set-top boxes from OEM Videostrong ship with a factory-installed backdoor (XCPE) that sold access for ad fraud, residential proxies and more malware; 1.3M+ devices (Google)"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Videostrong Android TV set-top boxes", "fixed": [], "vendor": "Videostrong Technology Co."}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-02T13:42:02+00:00"
updated_at: "2026-11-02T13:42:02+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-02T13:42:02+00:00"}]
---

# Android TV set-top boxes from OEM Videostrong ship with a factory-installed backdoor (XCPE) that sold access for ad fraud, residential proxies and more malware; 1.3M+ devices (Google)

Google Threat Intelligence (2 Nov 2026) reports that Android OEM/ODM Videostrong Technology Co. deliberately preloaded the x.cpe backdoor (com.oemservice in some builds) in the firmware of many set-top box models and brands since at least late 2024. It runs with system privileges, reinstalls itself from the /oem/ partition after removal, turns off Google Play Protect, and takes commands over MQTT: silent app installs, shell commands as system, screenshots, keystroke injection, network reconnaissance and data theft. Operators also opened reverse shells. Videostrong sold access to affiliates whose modules (Linkfog, AppSalt, NetNut proxies; CBOXTV, HiddenView ad fraud; Moyu, Spirit backdoors) used the devices for ad fraud and as residential proxy exit nodes. Google and partners (Japan NPA, Lumen, HUMAN, Plume, Synthient, TrendAI) took down the C2 last week and cut off Videostrong. Google estimates 10M+ more devices were reached through the affiliates' other channels. The backdoor stays in the firmware of devices already sold. The full list of affected brands and models is unknown.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :Videostrong Android TV set-top boxes affected ? fixed ?

## How to check

Look for Android TV boxes or set-top boxes on office or home-office networks (Videostrong-made; builds with the ro.mecool.device property or YokaTV Player) that have the packages x.cpe, com.oemservice or com.abc.nexus. In DNS, proxy or firewall logs, look for traffic to *.anyevonline.com:8000 (e.g. mcstb.anyevonline.com, stb*.anyevonline.com), mqtt.szbboys[.]com or ott.szbboys[.]com, or MQTT traffic leaving these devices. Also look for corporate IPs listed as residential proxy exit nodes.

## Fix

Take Videostrong-made or uncertified Android TV boxes off corporate and production networks and replace them. A factory reset does not help, because the backdoor is in the firmware. If a box must stay, put it on an isolated VLAN that has no route to internal systems. Block anyevonline.com and szbboys.com at DNS and the egress proxy. Check for unexpected outbound proxy traffic from those network segments.

## Timeline

- 2026-11-02T13:42:02+00:00 analyst

## Documents

- [describes] Google Threat Intelligence: Shutting the Door on the XCPE Botnet https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet/

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_