Google has ended its relationship with Videostrong Technology, which makes Android TV boxes. The company is accused of pre-loading a backdoor called XCPE onto more than 1.3 million devices. The backdoor reportedly used obfuscation to avoid detection during Google’s screening, and it connected the devices to a botnet that Google has since shut down.
The backdoor was found in the firmware of multiple Videostrong devices, including the Mecool KTI, and in several white-label Android TV boxes. Synthient, a Seattle security research group that helped Google analyze it, says at least 182 models were infected and joined the botnet.
According to the findings, the malware took advantage of a firmware vulnerability in the Android boxes to load malicious code once the devices booted for the first time. Videostrong first deployed it in 2024 as a simple, single-stage dropper, then spent the next couple of years rebuilding it into a modular, three-stage design that was harder to knock out and allowed multiple parties to profit from it.
The malware also appeared in other Videostrong products: telehealth devices, karaoke machines, and digital signage. Obfuscation helped it pass Google’s certification tests. It then disabled Play Protect, Android’s real-time malware protection.
Google’s Threat Intelligence Group says the infected devices became part of a global botnet that criminals used to commit ad fraud, steal data, capture screenshots, inject keystrokes, and open remote shells. The compromised devices were also signed up to proxy networks, which routed unauthorized traffic to command-and-control servers run by the attackers.
Google found XCPE on several device models from multiple brands, spread with the help of dedicated infrastructure. The backdoor was designed to evolve, changing its characteristics to evade detection as the botnet grew rapidly.
The Shenzhen-based OEM is reported to have monetized the backdoor by allowing cybercrime syndicates to load their own malware modules onto infected devices. These secondary modules were meant to carry out ad fraud and enroll the devices in residential proxy networks, as well as to install additional malware.
Google worked with several international law enforcement agencies and cybersecurity firms to map the XCPE ecosystem and take down the command-and-control domains used by the botnet’s operators and their affiliates. The partners included Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI.
Google’s estimate is about 1.3 million affected devices, but Trend Micro’s count is higher. It says it found 1,472,554 infected devices spread across the US, Canada, Germany, the UK, Australia, Brazil, Malaysia, Iraq, Mexico, and Taiwan.
To head off a repeat, Google has blacklisted Videostrong and its affiliates from producing certified Android devices and from providing software to other Android vendors and Google partners. It is also revising the certified Android program with a focus on firmware integrity.
Maybe you would like other interesting articles?