Videostrong

Videostrong Technology Co. is a China-based Android device manufacturer that intentionally developed, preinstalled and operated the XCPE backdoor for financial gain. It supplied compromised devices to multiple brands and sold criminal affiliates access to infected devices, deploying their malware for advertising fraud, residential proxy services and further malware delivery. XCPE infected more than 1.3 million devices worldwide, predominantly Android TV set-top boxes, with additional infections in telehealth equipment, karaoke machines and digital signage systems. XCPE is embedded in device firmware, operates with system-level privileges and reinstalls itself after removal and reboot. Its operators use obfuscation, native anti-analysis utilities and delayed malicious-code loading to evade security testing and sandbox detection. The malware disables Google Play Protect and enables silent application installation. Since at least late 2024, its architecture has separated the core backdoor from a modular loader that deploys native binaries, embedded SDKs and additional applications. Distributed components include residential proxy modules, advertising-fraud malware and the Spirit, Moyu, Bird and Fission backdoors. Multiple proxy SDKs can operate simultaneously on a single device. Observed operator activity includes capturing screenshots, injecting keystrokes, stealing account and device information, and opening reverse shells. Google and security partners disrupted XCPE infrastructure in 2026 and targeted command-and-control infrastructure used by more than a dozen associated malware families. Google also barred Videostrong from the certified Android ecosystem and strengthened device-review procedures. The infrastructure disruption did not remove the firmware-resident implants from affected devices.