By Tsuky 
A customer buys an Android streaming box, connects it to a television and adds it to their home Wi-Fi network.
The device appears to work normally.
But on some products investigated by Google, malicious software was already present in the firmware supplied by the manufacturer.
No suspicious download or phishing message was necessary.
The mechanism that enabled unauthorized access was part of the software shipped with the hardware.
Google Threat Intelligence Group described the operation in a report published November 2.
The botnet, known as XCPE, included more than 1.3 million devices, mostly Android television and streaming boxes.
Google and its partners disrupted the infrastructure used to control those systems during the previous week.
The case raises a particularly serious question about the connected-device supply chain: what happens when the manufacturer itself is accused of deliberately shipping compromised firmware?
Google attributes the operation to Videostrong
Google identifies Chinese device manufacturer Videostrong Technology as the main actor behind XCPE.
Videostrong operates as an original equipment manufacturer and original design manufacturer.
These business models involve building devices that may subsequently be distributed under different commercial brands.
The same underlying hardware and firmware can therefore appear in products with different names.
That makes identifying affected devices more complicated than checking a single brand.
Google says it has high confidence that Videostrong intentionally developed, deployed and operated the backdoor for financial gain.
The researchers argue that the activity was not simply a programming oversight or the work of one unauthorized employee.
This is a technical attribution made by Google and its research partners.
It should not be described as a final judicial finding against the company.
Reporting by BleepingComputer and Krebs on Security also describes technical evidence connecting the malicious infrastructure with Videostrong-associated resources.
Google has terminated its business relationship with the manufacturer.
The malware was embedded before customers received their devices
Many malware infections begin when someone downloads a malicious application or opens a compromised file.
XCPE worked differently.
The backdoor was included in the Android firmware itself.
It could therefore exist on the product before its first use.
The primary component was named x.cpe or, in some versions, com.oemservice.
Google reports that it operated with Android system-level privileges.
Those permissions can provide much greater control than an ordinary third-party application.
The component could communicate with remote servers and facilitate the installation of additional software.
The security failure is particularly serious because consumers normally trust the software delivered by the manufacturer.
In this case, the trusted foundation of the device contained the mechanism that enabled its compromise.
How did the backdoor evade Google's certification checks?
Google requires manufacturers seeking certification for certain Android devices to pass compatibility and security evaluations.
Those procedures are intended to establish a baseline of trustworthy behavior.
According to Google, Videostrong used obfuscation and delayed loading to avoid exposing all malicious components during testing.
The initial firmware could contain a component that downloaded additional functionality after the first boot.
This created a gap between the software initially examined and the behavior eventually observed on consumer devices.
The issue was therefore broader than a familiar malware signature being missed by an antivirus scanner.
It involved the way manufacturer-installed components and later downloads were evaluated.
Google says it has strengthened its review process and introduced changes intended to improve firmware integrity checks.
Those measures have been announced, but their long-term effectiveness remains to be demonstrated.
The backdoor could reinstall itself
XCPE was designed to maintain access over time.
The main malicious component was present in firmware storage.
When the device started, it could install an active application package.
If that application was removed, the component retained in the /oem/ partition could reinstall it during the next boot.
That persistence distinguishes the threat from ordinary unwanted applications.
Removing a suspicious entry from the Android application list might not solve the problem.
The underlying installer could still be present in a system partition.
A standard factory reset may also be ineffective if it preserves the compromised firmware.
The core issue is that the malicious functionality is part of the device's software foundation rather than something added only to user storage.
How XCPE provided remote control
The backdoor communicated with command-and-control infrastructure.
It first obtained configuration data and could report information about its environment.
The device then established a persistent connection using MQTT.
MQTT is a widely used messaging protocol for connected devices.
It is legitimate technology, but XCPE used it as a remote command channel.
Operators could send instructions and receive responses from compromised systems.
Google documented capabilities including silent application installation, shell-command execution, script downloads, screenshots and network reconnaissance.
Researchers also observed keystroke injection and sensitive information exfiltration.
This was therefore more than unwanted advertising software.
XCPE provided a flexible access mechanism capable of supporting several different malicious activities.
Access to compromised devices became a commercial product
Google says Videostrong monetized its installed backdoor by allowing criminal affiliates to deploy their own software modules.
Those affiliates could use compromised devices without the knowledge of their owners.
The business model depended on resources belonging to consumers: the hardware and the internet connections.
A single device could host several monetization modules.
Researchers observed systems running multiple components serving similar functions.
That allowed operators to seek several revenue streams from the same compromised equipment.
The architecture resembled a commercial ecosystem in which different actors specialized in initial access, malware delivery and monetization.
The user was left outside this arrangement despite owning the device being exploited.
Home internet connections became residential proxies
One of the main uses of XCPE involved residential proxy services.
A proxy forwards internet traffic through another connection.
Some legitimate services use this technology for specialized purposes.
However, the situation changes when the connection owner has not knowingly agreed to participate.
The malware allowed infected devices to become exit points for third-party internet traffic.
To outside services, some of that traffic could appear to originate from the victim's residential IP address.
The actual user did not necessarily know who was using the connection or what requests were being made.
Google identified modules associated with proxy and bandwidth-sharing services, including Linkfog and AppSalt.
Unauthorized proxy activity can create bandwidth, privacy and IP-reputation risks.
However, not every infected device necessarily performed the same activities.
Advertising fraud was another revenue source
XCPE also distributed advertising-fraud modules.
These programs can generate artificial advertising interactions without corresponding to genuine user engagement.
Some components operated without displaying visible advertisements.
The infected device could perform background activity while the owner was watching television or leaving the box idle.
The goal of advertising fraud is generally to generate revenue from artificial impressions, clicks or conversions.
For the device owner, the activity may be difficult to recognize.
Unexpected network use, sluggish operation or unusual software behavior could justify investigation.
But a device that appears normal is not necessarily free of malware.
Researchers found capabilities for surveillance and data theft
The investigation describes functions beyond residential proxy services and advertising abuse.
Google observed the ability to collect system information and inventories of installed applications.
Account-related information and system logs were among the sensitive data categories that operators could obtain.
Screen capture capabilities were also documented.
The malware could execute scripts and interact with privileged operating-system functions.
Such capabilities create serious security concerns for a device connected to streaming accounts, applications and a household network.
However, the existence of these capabilities does not prove that every affected user had account credentials stolen.
Technical capability and observed exploitation against an individual victim must be distinguished.
The malware evolved through several generations
Google traces the documented development of XCPE back to at least late 2024.
Later versions changed how additional modules were loaded and executed.
One architecture relied on a component known as com.abc.nexus.
The program received instructions from the primary backdoor and coordinated different monetization modules.
More recent versions introduced specialized droppers designed to deploy individual modules.
Google believes these changes may have helped the operation evade detection.
Researchers also found mechanisms intended to interfere with automated analysis and security instrumentation.
Some variants attempted to disable Android protections or obtain privileged installation positions.
The botnet was therefore not a static malware campaign.
Its operators modified its architecture over time.
More than 1.3 million devices were enrolled worldwide
Google reports that XCPE enrolled more than 1.3 million devices.
The infections were distributed globally.
Most affected systems were Android television and streaming boxes.
However, the researchers also observed other categories of connected equipment.
These included telehealth devices, karaoke machines and digital signage products.
The risk was therefore not limited to home entertainment hardware.
Some compromised platforms were used in professional or specialized environments.
The range of devices reflects the role of OEM and ODM manufacturers whose underlying hardware and firmware may appear under multiple brands.
Why Google also mentions 10 million additional devices
The 1.3 million figure refers to the XCPE botnet itself.
Google also estimates that disrupting command-and-control infrastructure used by related criminal affiliates will cut access to at least 10 million other compromised devices.
Those devices may have been infected through other distribution channels.
Some affiliates were not dependent exclusively on XCPE for installing their modules.
Targeting their control infrastructure could therefore affect systems outside the core XCPE network.
The two figures should not be combined into a single, uniformly measured Android TV botnet population.
They concern different sets of devices and different aspects of the operation.
The 10 million figure is an estimate of additional disruption, not proof of completed malware removal from every device.
Google worked with Japanese police and security companies
The operation involved cooperation between Google and several external organizations.
Google names Japan's National Police Agency alongside Lumen, HUMAN Security, Plume, Synthient and TrendAI.
The participants combined technical investigation with actions against the infrastructure used by the botnet.
Google says it pursued legal measures targeting servers and domains that controlled XCPE.
Related command-and-control infrastructure for more than a dozen malware families was also targeted.
The objective was to reduce the operators' ability to issue instructions to infected devices.
However, disrupting a remote server does not automatically erase malicious code stored on customer hardware.
Infrastructure takedown and endpoint remediation are different security operations.
Videostrong has been barred from certified Android manufacturing
Google announced that it had severed its relationship with Videostrong.
The company has been banned from manufacturing or selling future certified Android devices within Google's ecosystem.
Google also prohibited the manufacturer from supplying software to other certified vendors.
The restriction extends to future subsidiaries and affiliates.
The measure reflects the severity of the alleged supply-chain abuse.
Google acknowledges that its earlier certification process failed to prevent the malicious firmware from reaching users.
The company says it has improved its review process to address similar methods.
Whether those changes prevent future attempts will depend on their effectiveness against evolving supplier techniques.
Not every Android TV device is affected
XCPE does not mean every Android television or Google TV device is infected.
The investigation concerns particular hardware and firmware configurations.
There are differences between generic Android devices and products distributed through official Android TV or Google TV certification programs.
Certification provides a relevant security signal, although this case demonstrates that it cannot guarantee the absence of vulnerabilities or malicious behavior.
Google's main technical report does not provide a complete consumer-facing list of every affected retail model.
It would therefore be inappropriate to declare a specific box infected simply because it looks similar to another product or was sold at a low price.
Multiple brand names and shared manufacturing platforms complicate identification.
How consumers can evaluate their own devices
Users can begin by identifying the exact model and manufacturer of their streaming device.
Where Google Play is available, the Play Protect certification status may provide useful information.
However, certification alone is not absolute proof that a device is safe.
It is also worth checking whether the manufacturer provides regular security updates and identifiable support channels.
Unknown applications, unexpected installations and unexplained network activity may warrant investigation.
Nevertheless, XCPE was designed to operate discreetly.
The absence of obvious symptoms cannot establish that a device is clean.
Likewise, a slow or unusually warm streaming box is not automatically infected with XCPE.
Those symptoms have many possible explanations.
A factory reset may not remove the infection
XCPE's firmware-level persistence creates a major remediation challenge.
If the backdoor is stored in a system partition, a standard factory reset may leave the compromised component in place.
The active malware package could then be reinstalled when the device restarts.
A reliable fix may require clean firmware from a trustworthy source.
That is not always available for devices with limited manufacturer support.
Downloading an unofficial firmware image from an unknown website could introduce additional risks.
For a device with a confirmed infection and no trustworthy remediation path, disconnecting it from the network and considering replacement is a reasonable precaution.
Users should rely on security information relevant to their exact hardware.
An unverified suspicion should not be treated as a confirmed infection.
The issue extends beyond inexpensive TV boxes
XCPE demonstrates that device security depends on the entire manufacturing and distribution chain.
A product may function normally while containing dangerous system software.
The underlying platform may be distributed under several retail brands.
Customers usually have limited ability to inspect the firmware before purchasing.
Responsibility therefore extends beyond individuals downloading suspicious applications.
Google emphasizes the need for stronger controls among manufacturers, distributors and marketplaces.
Residential proxy providers also face questions about how they obtain customer consent.
A service that claims to use voluntarily shared residential bandwidth should be able to demonstrate genuine, auditable permission.
Silent enrollment through preinstalled software is not meaningful consent.
A major disruption, but not the end of the threat
The November 2 announcement represents a significant blow to XCPE.
The operation targeted infrastructure associated with more than 1.3 million directly enrolled devices and multiple related malware families.
It also led Google to sever ties with a manufacturer accused of turning customer hardware into criminal infrastructure.
However, researchers warn that illicit residential proxy networks and malware distribution businesses can adapt.
Operators may change servers, software modules or distribution methods.
Already compromised devices may retain malicious components inside their firmware.
The scale of XCPE therefore demonstrates both the value of coordinated disruption and the difficulty of restoring trust across a hardware supply chain.
The central lesson is troubling: when a connected product ships with a backdoor, the owner may lose control of their own internet connection without ever making a security mistake.
In this case, the first line of defense should have been established long before the device reached a living room, during design, manufacturing and certification.