What we know so far: Google has severed ties with Android TV box manufacturer Videostrong Technology over allegations that it pre-loaded a backdoor on more than 1.3 million set-top boxes. Dubbed XCPE, the backdoor reportedly used "obfuscation techniques" to evade Google's screening process and enrolled infected devices in a massive botnet that has since been shut down by the search giant.
The backdoor was discovered in the firmware of multiple Videostrong devices, such as the Mecool KTI, as well as several white-label Android TV boxes. Seattle-based cybersecurity and fraud intelligence research group Synthient, which worked with Google to analyze the malware, claims it identified at least 182 different device models that were infected with the backdoor and enrolled in the botnet.
The malware reportedly exploited a firmware vulnerability in Android boxes to load malicious code after the devices booted for the first time. First deployed in 2024 as a simple, single-stage dropper, the malware was rebuilt by Videostrong over the next couple of years with a modular, three-stage architecture, making it more resilient and enabling multi-tenant monetization.
In addition to Android set-top boxes, the malware was detected in several other Videostrong products, including telehealth devices, karaoke machines, and digital signage. The backdoor used various obfuscation techniques to bypass Google's certification tests and disabled Play Protect, Google's security tool that provides real-time malware protection on Android devices.
According to Google's Threat Intelligence Group, the infected devices were incorporated into a global botnet that allowed criminals to commit ad fraud, steal data, capture screenshots, inject keystrokes, and open remote shells. The compromised devices were also enrolled in proxy networks to route unauthorized traffic to command-and-control servers operated by the criminals.
Explaining Videostrong's role in spreading the XCPE backdoor, Google said it had detected the malware in several device models from multiple brands and that its distribution was supported by "dedicated infrastructure." The company added that the backdoor was designed to evolve throughout its lifetime, changing its characteristics to evade detection as it enrolled more devices in a rapidly growing botnet.
The Shenzhen-based OEM reportedly monetized the backdoor by allowing cybercrime syndicates to load their own malware modules onto infected devices. These secondary modules were designed not only to commit ad fraud and enroll compromised devices in residential proxy networks but also to install additional malware.
To analyze the XCPE ecosystem and take down the command-and-control domains used by botnet operators and their affiliates, Google worked closely with several international law enforcement agencies and cybersecurity firms, including Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI.
It is worth noting that while Google estimates the total number of affected devices at around 1.3 million, TrendMicro says it counted a total of 1,472,554 infected devices across the US, Canada, Germany, the UK, Australia, Brazil, Malaysia, Iraq, Mexico, and Taiwan.
Google says it has taken multiple steps to prevent similar incidents from happening again, including banning Videostrong and its affiliates from manufacturing certified Android devices or supplying software to other Android vendors and Google partners. The company is also improving its certified Android program to ensure firmware integrity.