x.cpe

XCPE is a firmware-embedded Android backdoor used to establish a botnet comprising more than 1.3 million devices worldwide. Infections predominantly affected Android TV set-top boxes, with additional infections identified in Android-based telehealth equipment, karaoke machines, and digital signage. The financially motivated operation is attributed with high confidence to Chinese device manufacturer Videostrong Technology, which embedded the malware in devices supplied across multiple brands and sold access to criminal affiliates.

XCPE runs with Android system privileges and uses MQTT for command-and-control communications. It supports silent application installation and removal, shell-command execution, screenshot capture, keystroke injection, account and device information collection, local-network reconnaissance, and reverse-shell access. Its modular architecture separates the core remote-control agent from a loader and affiliate payloads. These payloads monetize compromised devices through residential proxy services, bandwidth sharing, advertising fraud, and further malware installation.

The backdoor persists in device firmware and can reinstall its application after removal and reboot. Obfuscation and delayed loading of malicious code after initial boot helped evade device certification checks. XCPE can also disable Google Play Protect verification, allowing additional applications to be installed without normal security screening. Later distributed droppers added privilege-escalation functionality and persistent modifications to protected system partitions.

Google and industry partners disrupted XCPE infrastructure in late October 2026 and targeted infrastructure supporting affiliated malware families. The disruption interrupted operator access but did not remove firmware implants from affected devices. Google subsequently barred Videostrong and its future subsidiaries or affiliates from certified Android device production and software supply to certified vendors.