Google Dismantles XCPE Backdoor Infecting 1.3 Million Android Devices
Google has banned Videostrong Technology after discovering their XCPE backdoor infected 1.3 million set-top boxes with ad-fraud and remote access malware.
Google and partners dismantled the XCPE backdoor, which infected over 1.3 million set-top boxes into a botnet. Google attributes the malware to Videostrong Technology Co., an Android OEM and ODM that built and deployed the code to generate profit. The code bypassed Google testing by using obfuscation to load malicious functions after the initial device boot.
Since late 2024, the malware has operated via a three-stage design. Stage one is the x.cpe backdoor, running as com.oemservice from the /oem/ partition with android.uid.system privileges to reinstall itself on reboot. Stage two is the com.abc.nexus loader, which uses native anti-analysis code and a seccomp-based library to evade sandboxes. Stage three consists of monetization modules deployed as native ELF daemons, embedded SDKs, or secondary APKs.
Identified proxy modules include Linkfog, AppSalt, and NetNut, while ad-fraud modules include CBOXTV and HiddenView alongside Moyu and Spirit backdoors. Since August 2026, operators pushed new droppers over MQTT while uninstalling com.abc.nexus. These droppers disguise themselves as system apps, restart adbd as root, remount the system partition read-write, and copy themselves into /system/priv-app/.
Communication begins with an AES-encrypted HTTP POST sending device serial numbers, MAC addresses, models, and firmware versions, followed by a persistent MQTT connection for commands like silent APK installs, remote shell execution, and screen captures. The backdoor disables Play Protect verification by setting package_verifier_user_consent to -1. Google cut ties with Videostrong, banned the company and its subsidiaries from certified Android production, and updated its firmware review checks for certified Android TV devices.