What happened
Google's Threat Intelligence Group, Japan's National Police Agency and security firms Lumen, HUMAN Security, Plume, Synthient and TrendAI have disrupted XCPE, a backdoor built into the firmware of Android TV set-top boxes. Google attributes the operation with high confidence to Chinese OEM and ODM Videostrong Technology Co.
More than 1.3 million set-top boxes across more than 200 countries were enrolled. Google says Videostrong deliberately preloaded the backdoor and sold access to criminal affiliates, who pushed their own modules onto the boxes.
The backdoor runs at the android.uid.system privilege level and is preloaded in the firmware partition as x.cpe, running as com.oemservice in some builds. It uses a modular, three-stage design: the primary backdoor handles C2 communications, a loader (com.abc.nexus) runs modules, and monetisation modules from affiliates do the work. Those modules turned devices into residential proxy exit nodes (Linkfog, AppSalt/Honeygain, GaGaNode, NetNut, Traffmonetizer), ran ad fraud (CBOXTV, HiddenView) or installed further backdoors (Moyu, Spirit, Bird).
Infected devices first make HTTP POST requests to fetch config, then open a persistent MQTT connection to receive commands. The malware contacts anyevonline[.]com for connection details and credentials, then connects to an MQTT broker hosted at mqtt.szbboys[.]com. Operators could silently install apps, disable Google Play Protect, run shell commands with system privileges, take screenshots, inject keystrokes, collect account and device data, and open reverse shells.
Taking down the affiliate C2 domains is assessed to sever access to at least 10 million additional compromised devices, which arrived through other channels and include retail set-top boxes, karaoke machines, telehealth hardware and digital signage. Not all are Android devices.
Timeline
- Late 2024: Videostrong moves from single-stage droppers to a modular architecture.
- 3 June to 1 October 2026: TrendAI documents more than 3.8 million distinct home and mobile IP addresses tied to the operation.
- August 2026: Operators begin replacing com.abc.nexus with smaller droppers disguised as system apps that use a privilege escalation exploit to write to the system partition.
- Week of 26 October 2026: The coalition takes down the C2 domains and servers.
- 2 November 2026: Google discloses the disruption and bans Videostrong.
Am I affected?
This is a consumer and IoT problem that lands on enterprise and home networks. You are at risk if:
- You or your users run cheap Android TV boxes, projectors or Android-based IoT. Synthient found the backdoor preinstalled on a MECOOL KM9PRO Max box bought in late 2025.
- You see outbound traffic to anyevonline[.]com or szbboys[.]com, or MQTT connections to mqtt.szbboys[.]com or mqtt.anyevonline[.]com.
- Devices show packages named x.cpe, com.oemservice or com.abc.nexus.
Remember the backdoor is in firmware, not an app a user installed.
What to do now
- Block and alert on DNS lookups to anyevonline[.]com and szbboys[.]com and their subdomains at your resolver.
- Block outbound MQTT (typically 1883 and 8883) from untrusted IoT and TV devices.
- Put consumer streaming boxes and Android IoT on an isolated VLAN with no access to internal systems.
- Identify affected boxes. For an infected device, either reflash with clean, trusted firmware or disconnect it from the internet. Deleting the app does not work.
- Treat any data that passed through an infected box as exposed: account details, system logs and anything on that network segment.
How to hunt
- Search DNS and proxy logs for anyevonline[.]com, szbboys[.]com and file.anyevonline[.]com.
- Look for persistent MQTT sessions from TV boxes and IoT to external brokers.
- Flag devices whose Google Play Protect is disabled without user action.
- Inventory Android-based devices and check for com.oemservice, x.cpe and com.abc.nexus.
What does not help
- Uninstalling the app or doing a factory reset will not remove the infection. The primary backdoor reinstalls from the /oem/ partition on reboot.
- Relying on Google Play Protect will not help: the malware rewrites the setting that verifies packages and switches it off.
Sources
- Cops bust botnet of 1.3M infected Android TV boxes, The Register Security, 2 Nov
- Shutting the Door on the XCPE Botnet, Google Threat Intelligence, 2 Nov
- Google disrupts million-device XCPE Android malware botnet, bans TV box maker, BleepingComputer, 2 Nov
- Google disrupts XCPE botnet, bans the company behind it, Help Net Security, 2 Nov
