Videostrong's Backdoor Outlived Its Servers; 182 TV Box Models Are Listed

On Monday, Nov. 2, the day Google announced it was barring Videostrong Technology Co. from certified Android, the Shenzhen company's own website still listed a "Google Certified Android TV Box" and a "Google Certified Android TV Stick," The Hacker News reported.

That detail is the whole story in miniature. The servers that controlled more than 1.3 million backdoored set-top boxes are down. The code that obeyed them is not. For anyone holding one of these boxes, the takedown changed who can talk to it today, not what is installed inside it.

Google's threat intelligence group, working with industry partners, says it dismantled the control side of the botnet "last week." Google calls the botnet XCPE, which KrebsOnSecurity says is named for a core code component, x.cpe. The Hacker News dates the loss of its servers to late October. Google says "with high confidence" that Videostrong built and ran the backdoor on purpose, for money. That is Google's assessment, not a court ruling, and Videostrong "did not immediately respond" to The Register. Google took legal action against the control domains, banned Videostrong from making certified devices, and estimates the move severs access to at least 10 million more compromised devices. The details are in Google's own technical report.

Security firm TrendAI, one of the partners, put the limit plainly: removing its two central servers "cut the operator off from the devices, although the implant remains on each box." The Hacker News was blunter: owners cannot remove the backdoor themselves.

A system app that rebuilds itself

Most malware needs an invitation: an app you sideload, a link you click. This was already in the box. Google says x.cpe (called com.oemservice in some builds) is "preloaded in the firmware partition" and runs "at the android.uid.system privilege level," Android's own system-level identity. Its verdict: "As a system preload, x.cpe cannot be removed by the user." Uninstall it anyway and it "automatically reinstalls from the /oem/ partition upon reboot." TrendAI adds that it is signed with the manufacturer's key, so cleanup needs vendor action, platform protection or a new device.

On boot, the box sends an encrypted request with its serial number, MAC address, model and firmware version to an address on a Videostrong-controlled domain, anyevonline[.]com (earlier versions used szbboys[.]com). It gets back a message server's details and then holds a permanent connection to it using MQTT, a protocol built for light, unreliable links. Think of a switchboard line that never hangs up.

What the operator could say is the part that matters inside a home. Google lists silent installation of apps, shell commands with system privileges, continuous screen capture and injected keystrokes. It also lists switching off Google Play Protect's app verification, by setting "package_verifier_user_consent" to -1. The safety net is switched off by the thing it exists to catch. Google saw operators capturing live screenshots and exfiltrating account information. TrendAI found silent-install commands reached "more than 187,000" devices, judged by download counts.

Google says Videostrong sold access to criminal affiliates and loaded their malware modules, and most of those modules turn your broadband into someone else's. A residential proxy service sells access to a home internet connection, so a customer's traffic appears to come from an ordinary household. Picture a fraud screen that distrusts data-center addresses but waves through a family's ordinary line. TrendAI says traffic from a real household address "passes IP reputation and geolocation checks that banks, retailers and online services rely on." A TV that watches you with its maker's permission is one thing; a box whose maker, by Google's account, sold access to strangers is another.

The other income was ad fraud. Google describes a module called Fission that fetched ad responses in the background and fired the tracking requests to "register a fake ad view without displaying creative content." Another, HiddenView, simulated scrolling and clicking in hidden web views. The screen showed nothing, but the tracking requests still registered a view.

What 1.33 million boxes were scheduled to do

These were not dormant. TrendAI's telemetry, covering June 3 to Oct. 1, counted 1,472,554 infected devices, and about 1.33 million had proxy and ad-fraud modules scheduled. By Daybreak's calculation that is 90.3 percent, roughly nine boxes in ten put to work.

TrendAI also measured the rental stock. Residential addresses available on a single day averaged 182,025, with a peak of 366,562. Against the fleet, that is 12.4 percent on an average day and 24.9 percent at the peak, again Daybreak's arithmetic. TrendAI warns that "Collection was intermittent, so every figure is a lower bound on the true fleet."

Those addresses sat on ordinary service, TrendAI says: Comcast, Charter and AT&T in the U.S., Virgin Media in Britain, Vodafone in Germany. The household behind the line could find its address used in someone else's login attempt. TrendAI cites a HUMAN report that buyers of a related BADBOX proxy service used such access for account takeover and fake-account creation. KrebsOnSecurity calls such services a major source of malicious traffic. TrendAI, to be fair, "did not observe any specific buyer of this fleet's proxy capacity."

So the chain has three layers of renters: Videostrong, its affiliates, and whoever pays the affiliates. Google names proxy kits including Linkfog and AppSalt, and says a single box carried "as many as three residential proxy SDKs." Consent was a formality: Google says AppSalt, which it identifies as Honeygain's SDK (Honeygain is owned by Oxylabs), "explicitly calls the optIn() method which sets a consent flag without displaying any user interface." Oxylabs did not respond to Krebs. TrendAI notes pay-for-traffic services "are not necessarily malicious themselves. The abuse lies in how the operator enrolled devices without their owners' consent." As TrendAI puts it: "Owners lose control of the device, and nothing on the connected screen would even hint it."

What certification did not catch

Google's report says Videostrong "employed obfuscation techniques to exploit a gap in our tests and load malicious code after the device's first boot." Charley Snyder, head of disruption operations at the group, told CyberScoop:

"The XCPE operators constantly evolved its configurations to evade Google's pre and post-launch detections."

Charley Snyder, head of disruption operations, Google Threat Intelligence Group

Google says it has changed its review process, with "improvements to how we ensure the integrity of firmware on certified Android TV devices," but will not share specifics; CyberScoop reports the reason is to avoid helping attackers. The Hacker News notes the report does not say how many certified devices were affected, and Plume says the fleet "mixes AOSP (Android Open Source Project) and Google-certified devices."

The judgment here: certification is a photograph, and the vendor's firmware update channel is a video. The new firmware checks aim at that gap, but no source says they reach boxes already sold. That is why the owner's decision cannot lean on the sticker. It has to rest on the model name, the maker, and what a reset can actually do.

Which models, and what a name proves

Researchers at Synthient published Synthient's list of 182 model names seen in the campaign. Strings on it include KM9PRO, KM9PRO_MAX, KM7, KM2, M8S_PLUS, MECOOL, MXV-4K, INTV_1000, INTV-110, STV-3000_Plus, UHD_Google_TV_STB, PRO-M2, CBOX_3.0 and TV_Stick. The file carries its own warning: "A model name alone is not sufficient to confirm compromise." Absence is no clearance either: TrendAI counted 206 models, 24 more than Synthient lists (our subtraction).

The best-documented brand is MECOOL. A MECOOL KM9PRO Max Synthient bought in late 2025 carried com.oemservice, per AndroidPure; Synthient's published device specs show Google TV on Android 12 with a Feb. 5, 2025 security patch. Krebs reports Synthient concluded that MECOOL, sold by China's publicly traded Skyworth Technology, "also bundled the malware from Videostrong." No source quotes Skyworth or MECOOL. Krebs adds that MECOOL boxes surged after a 2023 mention by the Linus Tech Tips channel, which says it has since reframed the video as a scam warning and removed its affiliate links.

Vendor string in firmware	Devices Plume mapped	Plume's description
Droidlogic	189,352	Mix of products: SviCloud 9P/9S/10P/10S, SkyCom, BEM Maximus 6.0, WOW and others
ext-MECOOL	182,585	MECOOL / Strong Leap-S1 / generic "4K Android TV Box"
AB	92,482	Android 9 OEM image; PRO-M2 models popular in Iraq; CBOX_3.0, Pulse, Maximus 5.0
Google	59,031	Build.BRAND=google; includes INTV-110 (Steren Mexico), I-905, MyBox, 8S
Aquario	40,087	Brazilian retail STV-3000 Plus
VS	28,196	KM7, M8SPROW, DongleTV1, INTV_1000, Maximus
BB	13,197	YOKATV IPx series
Videostrong	964	KM7SE, INTV_ASIST, Steren INTV-1000, MegaFon KM8-ATV-MF

The table's lesson: MECOOL is the best-documented name but not the whole fleet. The biggest bucket is a mix of white-label products, "Google" builds sit among the entries, and two Latin American retail names appear. It is Plume's mapping, not a recall list.

TrendAI says most devices were in Malaysia, Brazil, Iraq, Mexico and Taiwan, while the United States, Germany, the United Kingdom, Australia and Canada "each had from about 26,000 through 42,000 devices." TrendAI counts more than 170 countries (Plume's release says more than 200).

Unplug first; a reset is the weakest step

The experts disagree. Synthient tells consumers to throw the boxes away for good. Plume recommends "a full factory reset," since modules may have added backdoors, but does not say whether a reset removes x.cpe itself. TrendAI says cleanup needs vendor action, platform protection or replacement. Plume's white paper also describes a newer LinkFog client that saves its device ID in several hidden places "To prevent losing device ownership across firmware updates, factory resets, or serial number spoofing."

No source says a reset removes the firmware piece, and none offers an official consumer scanner, a removal tool or a Google statement for owners of boxes already sold. So here is a judgment, labelled as one: if your model is on the list, stop trusting the box with anything you log into. Unplug it and replace it with a device from the partner list on Google's Android TV website, which Google says is the most current. Plume recommends a reset, and it is unlikely to hurt before you dispose of the box, but do not treat it as proof of a clean box.

• Read the model string on the box label and compare it with the list. A match is not proof; a miss is not clearance.
• Check whether the maker appears on Google's Android TV partner list.
• If you log DNS lookups, search for anyevonline.com, which Google lists as the current first-contact domain, and szbboys.com, which earlier versions used and which still hosts the MQTT broker. The servers are down, so a hit shows the attempt. That is our reading, not a source's instruction.
• If in doubt, unplug it, then sign out and change passwords for accounts used on it. This is precaution, inferred from Google's finding that operators exfiltrated account information.
• Skip any app that pays for "unused bandwidth," which Google calls a primary way illicit proxy networks grow.
• If you keep the box anyway, put it on a guest network. Synthient advises organizations to segment devices; for homes, that is our extension.

Expect this to repeat. The Register calls it part of the same ecosystem as BadBox 2.0, disrupted in March 2025. Krebs links proxy providers named in Google's report to the July 2026 NetNut seizures, and recalls the Kimwolf botnet Synthient documented in January. Google calls the market "resilient," and TrendAI notes such operators "have rebuilt on new infrastructure before"; Google says the droppers installed since August 2026 “may represent a new evolution of the malware.”

Google's report does not say how many certified devices were hit. As of Nov. 2, the maker's website was still listing products under the label.