XCPE Backdoor Found in 1.3 Million Android Devices; Google Bans Videostrong

Synthient reported a supply-chain compromise affecting at least 1.3 million Android-based devices, including MECOOL set-top boxes, with approximately 500,000 devices communicating daily with backend infrastructure. The investigation attributed the operation with high confidence to China-based manufacturer Videostrong Technology Co., Ltd., alleging that it embedded the persistent, system-level x.cpe backdoor in device firmware. Supporting evidence included shared infrastructure, backdoor-signing email addresses, and a document signed by Videostrong’s R&D director. Google permanently banned Videostrong and its future subsidiaries or affiliates from certified Android device manufacturing and software supply.

Google’s threat-intelligence report detailed how XCPE primarily compromises Android TV boxes, with infections also observed in telehealth devices, karaoke machines, and digital signage. The backdoor uses MQTT infrastructure and directs com.abc.nexus to deploy residential proxies, bandwidth-sharing software, advertising-fraud components, and additional backdoors. Payloads include Honeygain, NetNut/Popanet, Traffmonetizer, and others, enabling arbitrary traffic relay, dynamic payload execution, silent application installation, and clipboard hijacking; some operate without visible interfaces or bypass user consent. Synthient recommended disconnecting and disposing of affected devices, highlighting the risk of retaining hardware with a firmware-embedded compromise.