Loading malware…
com.abc.nexus, also known as ABCNexus, is an Android malware loader used within the XCPE botnet to configure and execute revenue-generating affiliate modules. Used since at least late 2024, it separates monetization payload execution from the primary XCPE backdoor, which handles command-and-control communications. The loader runs with Android system privileges and receives instructions through the backdoor to manage malicious modules on compromised devices.
Its payloads enroll devices in residential proxy networks, bandwidth-sharing services, and peer-to-peer content delivery networks without owners’ consent, and support advertising fraud. Individual monetization modules can be activated or deactivated remotely. The loader incorporates native anti-analysis protections and disables Google Play Protect to impede detection and security screening.
ABCNexus is deployed through XCPE infections originating in manufacturer-preinstalled Android firmware, predominantly on TV set-top boxes and other embedded Android devices. Google attributed the broader XCPE operation with high confidence to China-based manufacturer Videostrong Technology, which it accused of intentionally operating the botnet and selling access to criminal affiliates. Beginning in August 2026, XCPE operators started replacing ABCNexus with smaller, specialized droppers disguised as Android system applications.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
It handles communication with the control server and passes work to a loader called com.abc.nexus, which carries its own anti-analysis tricks and sets up the money-making modules.
The backdoor passed instructions to com.abc.nexus, a loader that configured affiliate modules.
The com.abc.nexus module ran with system privileges and enrolled each box in several revenue streams.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.