Google-certified Android TV boxes shipped with factory-installed XCPE botnet malware

Google's Threat Intelligence team has published a report exposing that Videostrong Technology, a manufacturer of Google-certified Android TV boxes, deliberately developed and deployed the XCPE backdoor on approximately 1.3 million devices. The malware evaded Google's certification testing through obfuscation techniques that delayed malicious code execution until after the first boot, creating a persistent botnet used for financial gain since at least late 2024.

The XCPE malware employs a three-stage architecture: a primary backdoor (x.cpe) preloaded in the firmware partition that self-reinstalls from /oem/ on reboot, a loader and execution engine (com.abc.nexus) with anti-sandbox capabilities, and monetization modules from third-party affiliates. Google has taken legal action to disrupt command-and-control domains, severed ties with Videostrong (revoking Google app preloads and certifications), and claims at least 10 million additional devices will be protected. Affected devices, including Videostrong and MECOOL brands such as the KM9Pro, can only be fully remediated by flashing custom firmware if available.

XCPE malware architecture and persistence mechanisms

• Primary backdoor (x.cpe): Preloaded in the firmware partition and automatically reinstalls from /oem/ upon reboot if removed, ensuring persistence against user remediation attempts.
• Loader and execution engine (com.abc.nexus): Configures monetization modules and employs anti-analysis utilities to evade sandbox detection, with capability to download additional malware through staging infrastructure.
• Affiliate monetization modules: Third-party developed components transform infected devices into residential proxy nodes (Linkfog, AppSalt, NetNut) or ad-fraud engines (CBOXTV, HiddenView), each connecting to separate Module C2 servers.
• Communication protocols: Malware uses HTTP and MQTT for C2 communications, with the majority of payloads hosted on GitHub and remainder on operator-controlled servers and file hosting sites.
• Certification bypass technique: Videostrong employed obfuscation to exploit gaps in Google's security testing, loading malicious code only after the device's first boot to evade pre-shipment detection.

Why it matters

This case exposes critical vulnerabilities in hardware supply-chain security for embedded Linux/Android devices and undermines trust in certification programs that consumers and enterprises rely upon. For the open-hardware and single-board computer communities, it reinforces the importance of auditable firmware, mainline Linux support, and community-maintained custom ROMs as the only viable remediation path when manufacturers compromise devices at the factory level. Google's subsequent certification process changes may set new precedents for how open- and closed-source firmware on embedded devices is validated before market release.