Threat intel

Google and a group of partners have taken down the servers behind XCPE, a backdoor that was built into the firmware of Android TV set-top boxes before they were sold. Google's Threat Intelligence Group (GTIG) published its report on November 2, 2026. It says more than 1.3 million devices were enrolled, and it attributes the backdoor "with high confidence" to Videostrong Technology Co., a Shenzhen device maker that builds firmware for its own boxes and for other brands. Google has banned the company, and any future subsidiaries or affiliates, from building certified Android devices or supplying software to certified vendors.

This matters beyond living rooms. The same cheap streaming boxes end up behind hotel TVs, in waiting rooms, on digital signage and in meeting rooms, and the infected list also includes telehealth devices and karaoke machines. Taking down the servers stops the operators giving orders, but the code stays on every box. If one of these devices sits on your network, it can still be used again.

How it works

The main component is a system app called x.cpe, sometimes shipped as com.oemservice. It runs with Android's system user ID, the same privilege as core operating system services, and a copy sits in the read-only /oem/ firmware partition. If you uninstall it, a boot receiver (code that runs at every start-up) reinstalls it from that partition on the next reboot. This is why owners cannot remove it themselves.

Before it installs anything, the backdoor wipes the stored user consent and changes the package verification setting so Google Play Protect stops checking new apps. Google says the malicious code loaded after the device's first boot, and that obfuscation let it slip through a gap in the compatibility and security tests Google runs before approving a device maker. Videostrong was an approved maker, so a "Google certified" label did not protect buyers here.

Control runs in two stages. At start-up the box contacts a registration server under anyevonline[.]com, with a subdomain picked from its Android version and device type, and gets back credentials for an MQTT broker at mqtt.szbboys[.]com. MQTT is a lightweight messaging protocol built for IoT devices, and current samples use it for all tasking. Through it the operators could silently install apps, run shell commands as the system user, take live screenshots, inject keystrokes, collect account details, device data, app lists and system logs, map the local network, and open reverse shells.

The design changed over time. From late 2024 a separate loader, com.abc.nexus, fetched and configured the money-making modules. Since August 2026 the operators have used smaller droppers disguised as Android system apps, which use a privilege escalation exploit to write themselves into the system partition. That makes the infection harder to remove than the original backdoor.

What the operators did with it

Google says Videostrong sold access to the boxes to criminal affiliates, who pushed their own modules onto them. The most common use was residential proxy and "bandwidth sharing" software, which routes paying customers' traffic through the owner's home or office connection so it looks like ordinary household traffic. The modules Google and BleepingComputer name include Linkfog, AppSalt (Honeygain), GaGaNode, NetNut and Traffmonetizer, and Google saw devices running up to three proxy SDKs at once. NetNut is the proxy network Google and the FBI disrupted in July 2026.

Other modules ran ad fraud, loading hidden pages and clicking ads, and some installed further backdoors. Two of them, Moyu and Bird, were previously tied to the BadBox operation that Google acted against in 2025. Because the affiliates also spread their modules through other channels, Google estimates that seizing their command domains cuts criminal access to at least 10 million more compromised devices.

Reports disagree on reach. CyberScoop cites more than 170 countries and The Register more than 200. Both CyberScoop and The Hacker News report TrendAI's finding that the largest concentrations were in Malaysia, Brazil, Iraq, Mexico and Taiwan. Synthient, one of the partners, found the backdoor preinstalled on a MECOOL KM9PRO Max box bought in late 2025. The disruption partners were Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI. The Register notes that no arrests have been announced, and Videostrong did not answer its request for comment.

What to do

1. Find the boxes. List every Android-based screen on your networks: guest and hotel room TVs, lobby and menu signage, meeting room streaming sticks, and anything staff plugged in themselves. Your DHCP leases and wireless controller client lists show device names and vendors. Treat any off-brand Android TV box as suspect, whether or not it carries a certification badge.
2. Check DNS and egress. Search resolver and proxy logs for any lookup of anyevonline[.]com or szbboys[.]com and their subdomains, then block both at DNS and the firewall. GTIG's report lists further broker IP addresses, ports and affiliate domains to add. A screen that makes MQTT connections or a steady spread of outbound connections to many unrelated hosts is behaving like a proxy node.
3. Check a suspect box. With ADB (Android Debug Bridge) enabled, run adb shell pm list packages | grep -iE "x.cpe|oemservice|abc.nexus". A match means the backdoor is there. Run adb shell settings get global package_verifier_user_consent as well: Google's report shows the backdoor setting this to -1. Look in /system/priv-app/ for apps you did not install, since that is where the newer droppers place themselves.
4. Replace or isolate it. Uninstalling the app does not stick, and a factory reset leaves the /oem/ partition the backdoor reinstalls from. BleepingComputer reports that only clean firmware removes it, and TrendAI says cleanup needs vendor action or replacement of the device. Synthient's advice to organisations is to disconnect and discard the boxes. Until you can, take the device off the network or keep it on its own isolated network segment.

Where a device has been used as a proxy, traffic from your public IP address may have reached other sites under your name. Check for abuse reports to your provider or blocklisting of your address, and look at what else on the same network segment the box could reach, since the operators had a reverse shell and a network reconnaissance tool.

Segment screens like untrusted devices

The lasting lesson is that firmware from the factory is part of your supply chain. Put TVs, signage and guest devices on their own VLAN (a separate virtual network) with no route to corporate systems, and give that VLAN default-deny egress that allows only the streaming and management services it needs. Buy from makers on Google's Android TV partner list, ask suppliers who builds the firmware, and recheck that list after actions like this one, because a certified badge on a box sold last year does not reflect a ban announced this week.

Our attack surface management work finds the devices on your networks that nobody listed, and our network penetration testing checks whether a compromised screen on a guest or signage segment can reach anything that matters. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

---

Sources: Google Threat Intelligence Group, Help Net Security, BleepingComputer, CyberScoop, The Hacker News, The Register, Brandefense, Krebs on Security.