Videostrong Technology Co

Videostrong Technology Co. is a China-based Android original equipment and design manufacturer associated with the financially motivated XCPE botnet operation. It intentionally preinstalled malicious firmware on more than 1.3 million Android TV set-top boxes and other connected devices, including telehealth equipment, karaoke machines, and digital signage systems. Videostrong supplied compromised devices to multiple brands and sold criminal affiliates access to infected devices, enabling advertising fraud, residential proxy services, data exfiltration, and deployment of additional malware. XCPE operates with Android system privileges and uses firmware-based persistence to restore its malware after removal and reboot. From at least late 2024, its malware evolved into a modular, three-stage architecture comprising a primary backdoor, the ABCNexus loader, and dynamically retrieved affiliate modules. Its capabilities include silent application installation, shell-command execution, screenshot capture, network reconnaissance, and collection of account information, installed-application inventories, and system logs. Defense-evasion measures include obfuscation, native anti-analysis utilities, system-application masquerading, and disabling Google Play Protect. Later droppers obtain root access and install privileged applications. Affiliate modules convert compromised devices into residential proxy exit nodes or generate fraudulent advertising impressions through hidden WebViews. Additional backdoors include Moyu and Spirit. In November 2026, Google and security partners disrupted XCPE infrastructure and associated affiliate operations. Google also barred Videostrong from producing devices with preloaded Google applications and strengthened Android TV firmware verification.