---
title: "When Google Certification Shields a Firmware Backdoor — Inside Videostrong's 1.47-Million-Device Android TV Betrayal"
url: "https://afengblog.com/en/blog/google-certified-xcpe-botnet-videostrong-android-tv.html"
language: "en"
author: "AFeng"
published: "2026-11-03T15:07:49.010Z"
category: "Security & Privacy"
tags: ["Cybersecurity","Engineering Retrospective","Supply Chain Security","Android TV","Botnet"]
reading_time: "30 min read"
description: "Google and six partners dismantled Videostrong's preloaded XCPE botnet on 1.47M certified MECOOL Android TV boxes, severing 10M+ proxy nodes worldwide."
---

# When Google Certification Shields a Firmware Backdoor — Inside Videostrong's 1.47-Million-Device Android TV Betrayal

> Google, Japan's National Police Agency, and five security partners dismantled the XCPE firmware backdoor preloaded onto 1,472,554 Android TV devices, taking the rare step of naming and permanently banning licensed certification partner Videostrong Technology (parent of MECOOL) while severing access to over 10 million downstream bots. By delaying payload execution until first internet boot to slip past factory testing, the vendor turned eFuse-locked bootloaders into a trap that blocks legitimate buyers from flashing clean open-source firmware.

## TL;DR

- Google, Japan's NPA, and five partners dismantled Videostrong's XCPE botnet across 1,472,554 measured devices and severed 10M+ downstream bots.
- A licensed Google Certified OEM delayed payload fetches until first boot to evade lab tests and set package_verifier_user_consent to -1 to kill Play Protect.
- An open C2 directory exposed a signed EU filing from Videostrong's R&D director, Skyworth-built MECOOL KM9PRO MAX tested positive, and 39 MECOOL items went offline.
- Boxes ran up to 3 proxy SDKs capped at 70% CPU, feeding USD 3.6B unicorn Oxylabs and DianxinAI gateways while relaying 44% of Japan's 3B-yen bank thefts.
- Mandatory eFuse-locked bootloaders block owners from flashing CoreELEC, while Videostrong pivots to AI companion robots after infecting its HC1 telehealth hub.

On November 2 and 3, 2026, the [Google Threat Intelligence Group (GTIG)](https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet), Japan's National Police Agency (NPA), [Plume](https://www.newswire.ca/news-releases/industry-takedown-of-botnet-hidden-in-more-than-1-3-million-tv-set-top-boxes-across-200-countries-817864283.html), [TrendAI](https://www.trendaisecurity.com/en-us/resources-insights/trendai-security-blog/trendaitm-research-helps-disrupt-android-tv-botnet-of-more-than-13-million-pre-infected-devices), [Lumen Black Lotus Labs](https://www.linkedin.com/pulse/xcpe-disrupting-key-power-source-proxy-botnet-operators-kix6e/), HUMAN Security, and [Synthient](https://synthient.com/blog/the-internals-of-a-badbox-operation) (working alongside the Motion Picture Association, MPA) announced a coordinated seven-party international takedown. Together, the coalition dismantled **XCPE** (packaged as `x.cpe` or `com.oemservice`), a firmware-resident botnet preloaded at the factory onto more than 1.3 million Android TV set-top boxes—with TrendAI measuring **1,472,554 unique infected devices** over a four-month control-channel window—while seizing command-and-control (C2) domains tied to more than a dozen downstream malware families and cutting criminal access to **at least 10 million additional compromised devices**.

Had the casualties been another wave of unbranded AOSP streaming boxes sold for tens of dollars on cross-border marketplaces, security researchers would hardly have blinked. What shattered industry trust was Google's rare decision to publicly name and permanently banish one of its own licensed certification partners: Shenzhen-based **Videostrong Technology Co., Ltd.** Having signed Google's official Android TV certification agreement back in 2017 and reported USD 92 million in 2024 revenue, this established OEM/ODM spent six years baking a backdoor into its flagship **MECOOL** retail lineup and carrier-branded hardware worldwide—even contaminating the `MECOOL KM9PRO MAX`, a dual Google TV and Netflix certified flagship contract-manufactured under Skyworth Digital's license.

A darker irony awaited buyers who paid extra for peace of mind. For years, cord-cutters and home-lab enthusiasts deliberately sought out the "Google Certified" badge to avoid tampered off-brand ROMs. Videostrong bypassed pre-launch certification simply by waiting until a consumer's first internet-connected boot to fetch live payloads—while Google's mandatory hardware eFuse Secure Boot and locked bootloaders permanently blocked those same buyers from flashing clean open-source Linux distributions like CoreELEC. The badge meant to guarantee platform integrity ended up serving as tamper-proof armor for a factory implant.

## Dormant Until First Boot — How a Certified OEM Evaded Testing and Disarmed Play Protect

Rewinding the past three years of Android streaming security makes clear why the Videostrong disclosures sent shockwaves through the ecosystem.

From [Lemon Group](https://www.trendmicro.com/en_us/research/23/e/lemon-group-cybercriminal-businesses-built-on-preinfected-devices.html) and the original [BadBox](https://www.humansecurity.com/learn/blog/badbox-peachpit-and-the-fraudulent-device-in-your-delivery-box/) disclosures in 2023, to QiAnXin XLab and Dr.Web exposing [Bigpanzi](https://blog.xlab.qianxin.com/bigpanzi-exposed-hidden-cyber-threat-behind-your-stb/) and the nearly 1.6-million-strong [Vo1d](https://blog.xlab.qianxin.com/long-live-the-vo1d_botnet/) botnet in 2024, to Google [suing 25 John Doe defendants](https://blog.google/innovation-and-ai/technology/safety-security/google-taking-legal-action-against-the-badbox-20-botnet/) in federal court in the Eastern District of New York after [BadBox 2.0](https://www.humansecurity.com/newsroom/human-exposes-badbox-2-0-scheme/) surpassed 10 million infected devices in 2025, Google security executives offered the exact same reassurance every single time: the victims were uncertified open-source AOSP knockoffs, whereas Play Protect certified devices underwent rigorous testing to keep users safe.

That talking point held until January 2026, when threat intelligence startup Synthient spotted clusters of officially Google-certified MECOOL set-top boxes inside anomalous proxy pools while tracking the local-network [Kimwolf botnet](https://krebsonsecurity.com/2026/01/the-kimwolf-botnet-is-stalking-your-local-network/). Placing the past four years of major pre-installed TV box botnets and residential proxy disruptions side by side reveals just how decisively that perimeter collapsed from within:

| Campaign / Malware Family | Disclosed | Core Investigating & Takedown Coalition | Measured Scale | Breached Google Certified Hardware | Core Persistence & Monetization Profile |
| :--- | :--- | :--- | :--- | :--- | :--- |
| **Lemon Group (Guerrilla)** | 2023-05 | Trend Micro | Operators claimed **8.9M devices** | No (off-brand phones, watches, uncertified boxes) | ROM-flashed `Sloth` loader; SMS OTP interception, reverse proxies, and adware plugins |
| **BadBox 1.0 & PEACHPIT** | 2023-10 | HUMAN, Google, Apple | **74K** firmware-infected boxes; **4B** daily spoofed ad bids | No (unbranded e-commerce AOSP terminals) | Preloaded Triada variant pulling hidden ad-fraud and residential proxy modules |
| **Vo1d (1.0 / 2.0)** | 2024-09 / 2025-02 | Dr.Web, QiAnXin XLab | Peak **1,590,299 daily active boxes** (226 countries) | No (aging uncertified AOSP 7.1–12 boxes) | `/system/xbin/vo1d` daemon with watchdog; PPI installs, click fraud, and SOCKS5 proxies |
| **BadBox 2.0** | 2025-03 / 2025-07 | HUMAN, Google, Trend Micro, FBI | Over **10M devices** globally (222 countries) | **No** (Google publicly stressed uncertified AOSP only) | Factory ROM implants plus third-party store repackaging; EDNY federal civil sinkholing |
| **Kimwolf & IPIDEA Takedown** | 2026-01 | Synthient, GTIG, Lumen, Cloudflare | Kimwolf **~2M devices**; served **550+ threat groups** | Primarily uncertified (first anomalous MECOOL leads surfaced) | DNS rebinding scanning LAN `ADB :5555`; Google seized 13 IPIDEA proxy brands |
| **NetNut / Popa Takedown** | 2026-06 / 2026-07 | Synthient, GTIG, FBI, Lumen | **>2M daily IPs** (linked to publicly traded Alarum) | Primarily off-store sideloading and white-label ROMs | Silent `io.popanet.Popa` enrollment without prompts; FBI and Google seized hundreds of C2 domains |
| **XCPE (Videostrong)** | **2026-11** | **GTIG, Japan NPA, Plume, TrendAI, Lumen, HUMAN, Synthient (+MPA)** | **>1.3M** direct (**1,472,554** measured) + **≥10M** downstream severed | **Yes (first confirmed licensed OEM deliberately backdooring Google TV / Android TV certified models)** | Vendor-built `x.cpe` + MQTT + `com.abc.nexus` running up to 3 concurrent proxy/PCDN SDKs; first permanent Google OEM ban |

How did a licensed manufacturer required to submit factory firmware images through Google's compatibility and security test suites slip a full-blown backdoor straight into read-only `/system/` and `/oem/` partitions?

![Three-column architecture diagram illustrating XCPE's first-boot certification bypass and Play Protect disablement, two-stage HTTP and EMQX MQTT command-and-control over ports 3885 to 3887, and the com.abc.nexus loader purging roughly 90 rival packages before deploying proxy and PCDN modules](https://afengblog.com/uploads/2026/11/ee12f90f9a4d69d0a039b389.webp "Figure 1 · XCPE's delayed first-boot certification bypass and three-stage multi-tenant control architecture, compiled from Google GTIG telemetry and the Plume Security Labs reverse-engineering whitepaper")

Cross-referencing GTIG's primary report with [Plume Security Labs' 55-page reverse-engineering whitepaper](https://cdn.plume.com/3d/92/f7c576bd4afabd79df4e7b39ca7f/xcpe-botnet-whitepaper-10-2026.pdf)—built on teardowns of over 150 complete Android TV factory firmware images and more than 100 malware binaries, alongside Plume's public [IoC repository](https://github.com/plume-design/security-labs/blob/master/2026-10-XCPE/xcpe.txt)—shows how Videostrong exploited the timing gap between lab certification and living-room deployment:

1. **Delayed First-Boot Activation and Silent Play Protect Disarmament**: Throughout Google's automated static scans and pre-release lab checks, the stub package `x.cpe` (or `com.oemservice`) baked into read-only partitions stayed inert behind code obfuscation, masquerading as a benign OEM system utility. Only after an end user unboxed the device, completed its first boot, and established live internet connectivity did the stub pull down malicious payloads. Running as `android.uid.system`, `x.cpe` immediately called `Settings.Global.putInt` to overwrite the global verification setting `package_verifier_user_consent` to `-1` (or executed a remotely fetched `google_protect_disable.txt` script), silently switching off **Google Play Protect** so subsequent APKs could install in the background without triggering a single warning dialog.
2. **Two-Stage Encrypted Bootstrap and a 450,000-Session EMQX Broker**: Upon waking, the implant checked `ro.mecool.device`—connecting to `http://mcstb.anyevonline.com:8000` (`mcstb` standing for MECOOL Set-Top Box) when `true`, or dynamically building `http://stb[AndroidVersion][Type].anyevonline.com:8000` otherwise. It uploaded AES-encrypted serial numbers, MAC addresses, model strings, and firmware versions in exchange for Stage-2 MQTT broker credentials, Google STUN servers for NAT traversal, and a file exfiltration endpoint at `http://ott.szbboys.com:8000/cpe/file/upload`. Millions of boxes then maintained persistent sessions with `mqtt.szbboys.com`, which [APNIC registry records](https://rdap.apnic.net/ip/219.134.163.210) resolve to China Telecom Guangdong (Shenzhen) IPs `219.134.163.210` and `219.134.163.211` on non-standard TCP ports `3885–3887`. Remarkably, the operators left the EMQX Prometheus metrics endpoint on port `:18083` wide open to the public internet—allowing Plume researchers on September 8, 2026 to capture an unauthenticated snapshot of **450,585 live concurrent MQTT sessions** (`424,108` on the main `Anyevonline` cluster with an all-time peak of **554,464**, plus `26,477` on the `YOKATV` cluster).
3. **Beyond Bandwidth Resale — Live Screen Spying and Remote-Control Injection**: Captured C2 traffic analyzed by GTIG and TrendAI proved the operators wielded intrusive surveillance capabilities far exceeding ordinary proxy ware. Beyond silently staging commercial SDKs, `x.cpe` used Java reflection to invoke Android's hidden `SurfaceControl.screenshot` API to **capture, compress, and upload live television screenshots in real time**, called `sendKeyDownUpSync()` to inject synthetic remote-control keystrokes, spawned privileged reverse shells on demand, harvested nearby Wi-Fi SSID/BSSID and Bluetooth device lists, and exfiltrated local account records alongside system logs.
4. **Six Years, Four Architectural Generations, and a Botnet Turf War**: The earliest `x.cpe` binary (`v3.6.5`) in Synthient's corpus dates back to **December 14, 2020**. Over six years, Videostrong pushed the implant through four distinct generations: starting around 2021 with basic HTTP polling, advancing to persistent EMQX sessions paired with an unsigned XML updater `VSOTAUpgrade` (`com.droidlogic.vsota`) and an SSH-backdoored `DebugTool` (`com.yk.debugtools`), and then pivoting in late 2024—right after Google's initial BadBox crackdown—to decouple monetization into a second-stage execution loader named **`com.abc.nexus`**. Hardened with a native `libseccomp_guard.so` library using seccomp syscall filters to block cross-process `ptrace` attachment and Frida instrumentation, `com.abc.nexus` also carried a hardcoded **blacklist of 81 to roughly 90 competing package names**, silently uninstalling rival implants like `CECbot` on sight to monopolize the victim's home bandwidth. When scrutiny intensified in August and September 2026, operators issued fleet-wide MQTT commands to purge `com.abc.nexus`, swapping in privilege-escalating droppers disguised as `com.android.system.ntp` (which dropped `libexploit.so` to remount `/system/priv-app/` read-write and spoofed factory timestamps via `persist.networkstack.install_time`), followed in late September by pure C++ native ELF daemons **`dw` / `dw1`** phoning home to `webnest.columbus2024.com` and an Allwinner H616 kernel-memory patcher (`com.codex.h616probe`) built to forcibly disable SELinux.

As Charley Snyder, head of disruption operations at GTIG, acknowledged in an interview with *[CyberScoop](https://cyberscoop.com/google-disrupts-xcpe-botnet-videostrong-android-devices/)*:

> "The XCPE operators constantly evolved its configurations to evade Google’s pre and post-launch detections."

## A Handwritten Signature in an Open C2 Directory — Tracing Shenzhen Bao'an and Dual-Track ODM Contamination

Whenever preloaded malware surfaces on consumer electronics, hardware vendors reach for one of two rehearsed alibis: blaming a "rogue contractor" or pointing fingers at an unnamed upstream board-support vendor. Google's official advisory slammed both doors shut with unusually blunt attribution:

> "We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co., an Android Original Equipment Manufacturer (OEM) and Original Design Manufacturer (ODM). ... We believe this campaign wasn’t an isolated rogue insider or a development oversight. As a result, Google has cut ties with Videostrong and banned them from making devices with preloaded Google apps."

What gave investigators the certainty to pin the entire enterprise directly on the corporate entity was a piece of operational carelessness bordering on dark comedy.

![Scanned EU Radio Equipment Directive Declaration of Conformity retrieved by Synthient from an open directory on the XCPE C2 server, showing Videostrong Technology's Shenzhen Bao'an address and the handwritten signature of R&D Director Owen Cao dated November 26, 2024](https://afengblog.com/uploads/2026/11/62d3e7871819a60dee960bfb.webp "Figure 2 · Scanned EU Declaration of Conformity pulled directly from the unauthenticated directory at file.anyevonline.com port 8000 under /pdf, exposing Videostrong's corporate address and R&D Director Owen Cao's signature (Source — Synthient Research Team)")

While auditing servers sharing XCPE's Stage-1 bootstrap domain, Synthient researchers discovered unauthenticated directory listing enabled on `file.anyevonline.com:8000/pdf`. Sitting inside was a scanned European Union Radio Equipment Directive (RED `2014/53/EU`) Declaration of Conformity dated **November 26, 2024**. The manufacturer field explicitly named **`Videostrong Technology Co.,Ltd`** at `6/F, Lushi Industrial East Building, Xin'an Street, Bao'an District, Shenzhen`—matching room `606` on [Videostrong's corporate profile page](https://www.videostrong.com/cn-about-10) and U.S. Federal Communications Commission [FCC Grantee Code `2AGKB`](https://fccid.io/2AGKB) word for word—complete with the handwritten ink signature of Videostrong R&D Director **`Owen.Cao` (`OWEN-CAO, R&D Director`)**.

Three independent technical links locked that smoking gun into an airtight attribution chain:

* **Shared Infrastructure Between Corporate Web and Botnet Admin**: Passive DNS records verified by Synthient confirmed that Videostrong's official corporate domain `videostrong.cn` resolved to the exact same server IP address as `mqtt.anyevonline.com`, the primary administration panel used by XCPE's operators;
* **Corporate Email Certificates and Named GitHub Accounts**: Developer signing certificates on multiple OTA update packages and backdoor binaries embedded `@videostrong.com` corporate email addresses, while the 11 GitHub accounts suspended for hosting malicious scripts and Stage-2 payloads included `github.com/yf-videostrong/` and `github.com/vspeng/`;
* **Pinyin Channel Initials Matching Corporate Milestones**: In MQTT plugin configuration payloads captured by GTIG, the Linkfog PCDN module carried the channel identifier **`"libChannel": "SZKJ"`**—the exact Pinyin initials for *Shizhuang Keji*, Videostrong's Chinese corporate name. Meanwhile, Videostrong's own corporate timeline boasts of signing Google's TADA certification agreement in **2017** and rolling out a proprietary cloud "Terminal Management System (TMS)" across all product lines in **2018**—mirroring the early malicious C2 subdomain `*tms.szbboys.com`.

![Supply-chain diagram mapping Videostrong's in-house non-Netflix line, Skyworth Digital and ZTE dual-certified Google TV and Netflix line, and overseas ODM rebrands converging into unified factory firmware infection across 188 models, alongside the four forensic attribution links that triggered Google's permanent ban](https://afengblog.com/uploads/2026/11/e91b6c9f6c988b6d1ee1b1ea.webp "Figure 3 · Videostrong's dual-track ODM cross-contamination and four-pillar attribution chain — in-house models, licensed dual-certified flagship boxes, and carrier-branded hardware all shipped with vendor-signed com.oemservice baked into read-only partitions, culminating in 39 of 40 MECOOL store items going out of stock overnight")

Even more troubling is how Videostrong's flagship retail brand **MECOOL** (alongside its white-label storefront YOKATV) spread the implant across a "dual-track" contract manufacturing pipeline.

According to [Videostrong's OEM dossier on Android TV Guide](https://www.androidtv-guide.com/oem/videostrong/), because Videostrong never held Netflix's stringent Hailstorm hardware certification license itself, its catalog split into two manufacturing tracks: models without Netflix certification (`KM1`, `KM3`, `KM6`, `KM7`, `KM8`, `KM9 Pro`, `KT1`, `KD1`, `KD2`, `KA1`, `KA2`) rolled off Videostrong's own Shenzhen lines, whereas its highest-volume Western retail stars boasting **dual Google TV and Netflix certification** were contract-manufactured under the licenses of **Skyworth Digital** (board codes `HP4...` / `HPR...`, covering `KM2`, `KM2 Plus`, `KM2 Plus Deluxe`, `KM7 Plus`, `KM9PRO MAX`, `KS3`, `KD3`, `KD5`, `MEgo1`, `MEon1`) or **ZTE** (`KT2`).

Did outsourcing hardware assembly to tier-one licensed OEMs keep those flagship boxes clean? Not at all. Working with the MPA, Synthient purchased a brand-new retail unit of the dual-certified flagship **[`MECOOL KM9PRO MAX`](https://www.androidtv-guide.com/streaming-gaming/mecool-km9pro-max/)**, powered by a Realtek RTD1325 SoC running Google TV (Android 12). Although its build properties declared `Manufacturer: SkyworthDigital`, firmware extraction proved it shipped from the factory with both the `com.oemservice` (`x.cpe`) backdoor and the `com.abc.nexus` loader signed by a `Skyworth Digital Technology` platform key. (To be clear, none of the seven investigating organizations accused Skyworth Digital or ZTE of operating XCPE; `Skyworth` remains listed on [Google's official Android Certified Partners directory](https://www.android.com/certified/partners/), whereas `Videostrong` and `MECOOL` have been scrubbed entirely.)

Beyond wiping out the MECOOL catalog, cross-checking [Synthient's public list of 188 infected `ro.product.model` identifiers](https://github.com/synthient/public-research/blob/main/2026/11/Videostrong/README.md) reveals how Videostrong's ODM business poisoned regional telecom carriers and electronics retailers worldwide—including Thai pay-TV giant **GMM Z** (`DongleTV1`), an all-in-one karaoke soundbar sold under a brand affiliated with Japan's **KYODO TV** (**`KARAxKARA` / `KARA-A2023`**), Russian telecom carrier **MegaFon** (`KM8-ATV-MF`), and major Mexican electronics retailer **Steren** (`INTV-ASIST`).

Google's enforcement landed overnight. Beyond permanently revoking Android certification for Videostrong and any future subsidiaries or affiliates, Google barred the company from supplying software components to any other certified OEM. Live queries against the [`mecool.com` official store inventory feed](https://www.mecool.com/products.json?limit=250) on November 3, 2026 showed **39 of all 40 listed products (97.5%—every single set-top box, streaming stick, and projector) flipped in bulk to `available: false`**, leaving a solitary generic wireless mini-keyboard in stock. Meanwhile, YouTube heavyweight Linus Tech Tips, which had mentioned MECOOL in a 2023 roundup video, moved within hours: writer James Strieb posted a [named disavowal on Reddit](https://www.reddit.com/r/LinusTechTips/comments/1xm52q9/ltt_promoted_a_malicious_android_tv_box/), stripped all affiliate links, and patched an explicit malware-scam warning into the original video.

## Three Proxy SDKs on One TV Box — Inside the Parasitic Ledger Feeding Unicorns and Bank Heists

Why would an established hardware manufacturer reporting USD 92 million in annual sales, employing more than 90 R&D engineers, and securing fresh FCC approval for a new wireless device (`2AGKB-AIR`) as recently as **September 28, 2026**—barely five weeks before the takedown—bet its entire legitimate business on factory firmware malware?

Follow the unit economics. Export set-top boxes and ODM manufacturing have long been a razor-thin commodity grind where a vendor collects a tiny one-time margin per unit shipped. Turning a million always-on living-room boxes into metered **residential proxy exit nodes and edge compute bots**, by contrast, transforms a low-margin hardware assembler into a high-margin global broadband landlord collecting recurring rent every month.

Before unpacking that underground monetization stack, it helps to reconcile the seemingly different device counts cited across coalition reports—each captures a distinct slice of the same operation rather than conflicting estimates:

* **`>1.3 million devices` (coalition baseline) vs. `1,472,554 devices` (TrendAI four-month telemetry)**: The joint press release cites a conservative deduplicated floor of "more than 1.3 million devices across over 200 countries." Sampling the MQTT control plane between June 3 and October 1, 2026, TrendAI directly counted **1,472,554 infected devices** across 206 models in more than 170 countries (roughly **1.33 million** of which were actively scheduled to run proxy and fraud payloads), logged over **2.36 billion MQTT control messages**, and extracted **3,849,226 unique residential and mobile exit IPs** (averaging over 182,000 available daily, peaking at 366,562 in a single day). Factoring in six years of cumulative shipments, Synthient CEO Benjamin Brundage told *[KrebsOnSecurity](https://krebsonsecurity.com/2026/11/tech-firms-dismantle-botnet-that-turned-1-3m-tv-boxes-into-proxies/)*: "The scale of affected devices is likely way higher. This is probably the largest operation against backdoored TV boxes that we’ve seen."
* **`≥10 million devices` (collateral disruption across the downstream ecosystem)**: The more than 12 downstream proxy and malware families renting access through Videostrong's backdoor simultaneously maintained massive node pools across uncertified white-label boxes and sideloaded apps. By seizing those downstream C2 domains through legal action, Google severed criminal access to **at least 10 million additional infected devices** outside Videostrong's own hardware footprint.

![World choropleth map published by Google Threat Intelligence Group showing global x.cpe botnet infection density, with dark blue hotspots in Malaysia, Iraq, and Brazil, medium blue across Europe and the Americas, and mainland China shaded in uncolored light gray](https://afengblog.com/uploads/2026/11/09ce7f1dc08a6f3e1868c12b.webp "Figure 4 · Global x.cpe infection density map disclosed by Google GTIG, showing heavy concentration across Southeast Asia, South America, the Middle East, and Western retail export markets while mainland China remains unshaded light gray (Source — Google Threat Intelligence Group)")

Pairing GTIG's global heat map with TrendAI's country rankings exposes an export-focused targeting profile: the top five infected territories were **Malaysia (`300,390` devices, first by a wide margin)**, **Brazil (`150,080`)**, **Iraq (`124,298`)**, **Mexico (`94,588`)**, and **Taiwan (`88,350`)**, with substantial footprints across Western and Asia-Pacific markets including the United States (`43,871`), Germany (`39,065`), the United Kingdom (`29,489`), and Hong Kong (`27,669`).

To squeeze maximum revenue out of each living-room box without causing 4K video stutter that might tip off the owner, Videostrong engineered disciplined resource throttling:

![Infographic breaking down single-box stealth throttling with up to 3 concurrent proxy SDKs capped at 70% CPU and 50% RAM yielding 3.85 million residential exit IPs, feeding Oxylabs Honeygain, Jaguar, SOAX, Linkfog DianxinAI edge gateways, and online banking thefts in Japan](https://afengblog.com/uploads/2026/11/e5a557caf03a2964a70ba1f9.webp "Figure 5 · Per-device triple-SDK stealth throttling and the downstream monetization web — linking 70% CPU caps and 3.85 million harvested home IPs to USD 3.6 billion proxy unicorn Oxylabs, DianxinAI edge gateways, and 3 billion yen in Japanese online banking fraud")

GTIG reverse engineers found Videostrong **running up to three competing residential proxy SDKs concurrently on a single TV box**, segmenting traffic across six regional time-zone server pools (`Pool1`–`Pool6`). Simultaneously, MQTT `ext/lib/config` policies enforced strict hardware ceilings—capping the Linkfog module at **`70%` CPU utilization, `50%` RAM usage, and a disk I/O limit of `5000`**. So long as streams played smoothly without crashing the UI, almost no household noticed tens of gigabytes of stranger traffic flowing silently through its router every day.

Tracing the 13 monetization modules deployed by `com.abc.nexus` upward stripped the veneer off several Western data unicorns and publicly traded proxy vendors that routinely market "ethical sourcing":

* **`AppSalt / Honeygain` Under a USD 3.6 Billion Unicorn**: Binary analysis caught the SDK red-handed—after reading keys from `libnative_keys.so`, it **bypassed every user-consent dialog and called `optIn()` directly to force home connections into its proxy pool**. Tellingly, the module checked its installation source at startup and immediately terminated itself if installed from the official Google Play Store, selectively hiding its non-consensual behavior from store reviewers. As KrebsOnSecurity noted, Honeygain's Lithuanian parent company **Oxylabs** had just raised USD 130 million led by Warburg Pincus in October 2026—rebranding as **Source** at a **USD 3.6 billion valuation**—and did not respond to requests for comment.
* **Global Proxy Heavyweights Rebuilding After Prior Takedowns**: Backbone telemetry from Lumen Black Lotus Labs exposed sprawling parasitic scale. **Jaguar**, which accelerates ChaCha20 proxy tunnels using ARM NEON instructions, averaged nearly **2 million daily victim IPs** worldwide—relying heavily on Videostrong's firmware preload to rebuild capacity after Google disrupted [IPIDEA](https://cloud.google.com/blog/topics/threat-intelligence/disrupting-largest-residential-proxy-network), then the world's largest proxy network, in January 2026. Subdomain servers for commercial proxy brand **SOAX** (averaging 800,000 daily and peaking near 1.3 million victim IPs) directly presented TLS certificates for [`emkmoh.com`](https://rdap.verisign.com/com/v1/domain/emkmoh.com), one of the XCPE domains seized by Google; **HailiangIP** (peaking above 1 million victim IPs) bootstrapped fresh nodes via seized domain [`io.pyuio.com:8700`](https://rdap.verisign.com/com/v1/domain/pyuio.com); and `GaGaNode` daisy-chained both `EarnFM` (~600,000 daily IPs) and **[PopaNet](https://krebsonsecurity.com/2026/06/popa-botnet-linked-to-publicly-traded-israeli-firm/)**, tied to Nasdaq-listed Israeli firm Alarum (parent of NetNut)—which bounced right back inside TV box firmware despite an [FBI and Google takedown](https://cloud.google.com/blog/topics/threat-intelligence/google-continued-disruption-residential-proxy-networks) just months earlier in July 2026. Videostrong even distributed a custom-packaged client (`com.vs.grass`) for decentralized AI web-scraping proxy darling **Grass**, directly contradicting its founder's public claim last year that Grass had no relationship with any TV box manufacturer.
* **Chinese PCDN Nodes and the `DianxinAI` Edge Gateway**: On the bandwidth-sharing front, **Dianxinyun (Linkfog)**—operated by [Beijing Linkfog Technology](https://apps.apple.com/cn/app/%E7%82%B9%E5%BF%83%E4%BA%91/id1611385033)—dropped a native Go binary (`lw_android_agent`) that opened FRP reverse tunnels to turn overseas, Hong Kong, and Taiwan living rooms into PCDN nodes. TrendAI further uncovered Linkfog operating **`DianxinAI`**, an edge-connected load-balancing AI API gateway that repackaged hijacked residential broadband as LLM API relay and edge-compute capacity—sharing device space alongside `TitanNet`, `Traffmonetizer`, and hidden-WebView click-fraud modules `Moyu`, `Bird`, `Fission`, and `HiddenView`.

GTIG tore apart the commercial residential proxy industry's compliance narrative in unusually stark terms:

> "Residential proxy providers have been able to flourish under the guise of legitimate businesses. While some providers may claim to behave ethically and only enroll devices with the clear consent of consumers, any claims of 'ethical sourcing' must be backed by transparent, auditable proof of user consent. In our analysis, these proxy operators only seek consent when they are forced due to platform policy and enforcement. Silent opt-in without user consent remains the most prevalent means by which devices are turned into exit nodes."

Having a streaming box hijacked as a proxy exit node is far worse than a slightly slower evening Netflix stream. When cybercriminals rent your home broadband IP for a few dollars, your residential router looks to bank fraud engines, government portals, and e-commerce risk filters like a clean local household connection.

That real-world crime wave explains why **Japan's National Police Agency (NPA)** stepped forward as the sole publicly named national law-enforcement partner in the takedown. According to an [official joint enforcement notice](https://www.npa.go.jp/bureau/cyber/koho/news/residentialproxy.html) and *[Cyber Police Agency Letter](https://www.npa.go.jp/bureau/cyber/pdf/R8_Vol.9cpal.pdf)* issued by the NPA, the Ministry of Internal Affairs and Communications, and NICT, out of 4,369 unauthorized online banking transfer cases across Japan in 2024 (Reiwa 6), **1,918 cases (roughly 44%)** were routed by overseas attackers through residential proxy stepping stones running on inexpensive home streaming boxes:

> 「このような踏み台となるIoT機器は「レジデンシャルプロキシ」と呼ばれ、令和６年にはインターネットバンキングに係る不正送金事犯の被害額のうち少なくとも約30億円がこれらを経由した攻撃により生じたものであることが判明しています。」
> ("IoT devices turned into such stepping stones are called 'residential proxies,' and it has been determined that at least roughly 3 billion yen in losses from unauthorized internet banking transfers in 2024 resulted from attacks relayed through them.")

To choke off that relay pipeline, the NPA convened its public-private [Residential Proxy Countermeasures Alliance](https://www.npa.go.jp/bureau/cyber/what-we-do/alliance.html) in September 2026. On **October 30, 2026 (UTC)**, the coordinated sinkholing operation struck (note that as of November 3, the specific U.S. federal civil docket behind Google's domain seizures remained under seal). Raw Verisign COM registry RDAP records preserved the takedown to the exact second: Videostrong's two core C2 domains registered through Alibaba Cloud (HiChina), [`anyevonline.com`](https://rdap.verisign.com/com/v1/domain/anyevonline.com) and [`szbboys.com`](https://rdap.verisign.com/com/v1/domain/szbboys.com), were placed into `clientHold` freeze at **`06:18:11Z` and `06:18:14Z`**—just **three seconds apart**—returning immediate `NXDOMAIN` responses. Hours later, GoDaddy-registered [`pyuio.com`](https://rdap.verisign.com/com/v1/domain/pyuio.com) (`13:14:38Z`) and Cloudflare-registered [`emkmoh.com`](https://rdap.verisign.com/com/v1/domain/emkmoh.com) (`16:53:06Z`) went dark in lockstep, while Lumen Black Lotus Labs null-routed associated proxy infrastructure across its Tier-1 global backbone.

## Locked Bootloaders Seal Every Escape Hatch — Why Infected Hardware Must Still Be Scrapped After the Takedown

In the wake of the domain seizures and backbone blackholing, two dangerously optimistic misconceptions have gained traction across enthusiast forums and tech blogs.

The first misconception, typified by coverage at *[9to5Google](https://9to5google.com/2026/11/02/google-android-tv-box-backdoor-shut-down/)*, assumes that because Google shut down the C2 domains distributing malicious modules, affected Android TV and Google TV boxes should now be safe to keep using. Coalition researchers at TrendAI and Synthient—echoed by *[Android Authority](https://www.androidauthority.com/android-tv-box-maker-google-botnet-malware-3730930/)* and *[Android Central](https://www.androidcentral.com/streaming-tv/google-takes-down-a-massive-android-tv-botnet-but-infected-devices-remain-dangerous)*—issued the exact opposite warning: **compromised units remain actively dangerous, and the only safe remediation is to unplug them from the network immediately, dispose of the hardware permanently, and rotate passwords for every account ever signed in on the box**.

TrendAI spelled out the architectural dead end in plain terms:

> "Owners cannot remove the implant themselves. It runs as a system app signed with the manufacturer’s key, so cleanup needs vendor action, platform protection or replacement of the device."

Sinkholing cloud domains does nothing to dislodge a mother implant fused into local read-only `/system/` and `/oem/` partitions. Triggering a factory reset from the settings menu ten times in a row only wipes the `/data/` user partition; the moment the box reboots, `BootReceiver` silently reinstalls the backdoor straight out of `/oem/`. Worse still, Plume already caught the fourth-generation native C++ implant `dw1` pivoting in late September to active fallback domains, and many boxes have had both Play Protect and kernel-level SELinux disabled—leaving them sitting on home LANs as pre-rooted time bombs awaiting secondary takeover.

The second misconception runs deep among hardware tinkerers and bargain hunters: "Never run stock firmware on export TV boxes—just flash a clean open-source build of CoreELEC or Armbian and call it a day."

Five years ago on uncertified generic AOSP boxes, that advice often worked. On the Google-certified MECOOL models at the center of this crisis, that escape hatch was welded shut at the factory.

![Two-part technical flowchart explaining why infected boxes survive C2 sinkholing via read-only /oem persistence and why Google and Widevine L1 eFuse Secure Boot locks out CoreELEC rescue, followed by a four-step root-free home triage pipeline using ADB and router DNS logs](https://afengblog.com/uploads/2026/11/64fa229b2ab44b1a8a6e82a0.webp "Figure 6 · Why eFuse-locked bootloaders trap certified buyers — read-only /oem persistence and dw1 fallback C2s defeat factory resets while Secure Boot blocks CoreELEC, leaving a four-step root-free ADB and router log audit as the fastest home check")

That is precisely the institutional irony fueling outrage across [Reddit](https://www.reddit.com/r/GoogleTV/comments/1xm6aqk/wtf_this_is_the_reason_why_mecool_is_out_of/) and [Hacker News](https://news.ycombinator.com/item?id=50345977). To satisfy mandatory Google certification and Netflix Widevine L1 DRM requirements, certified units including the `MECOOL KM2`, `KM2 Plus`, `KM7 Plus`, `KM9PRO MAX`, `KT2`, and `KD1–KD5` ship with **hardware eFuses physically blown to enforce Secure Boot and permanently lock the bootloader**. Because the boot ROM refuses any kernel or OS image not signed by the vendor's private key, [CoreELEC maintainers](https://discourse.coreelec.org/t/widevine-manual-installation/18810) and [frustrated owners](https://discourse.coreelec.org/t/coreelec-on-mecool-km2-plus/20356) confirmed years ago that certified MECOOL boxes cannot boot CoreELEC—and the Realtek RTD1325 silicon inside the newer `KM9PRO MAX` lacks mainline open-source Linux support altogether.

Throughout 2026, Google has steadily tightened restrictions on user-initiated APK sideloading in the name of "keeping users safe." Yet its pre-certification pipeline failed to catch a licensed OEM baking malware into `/oem/`, while independent security researcher Ethan Nelson-Moore noted on Hacker News that he has been analyzing another line of currently sold Google-certified phones and tablets preloaded with Triada malware without finding a responsive channel to report it to Google. Once the scandal broke and the vendor pulled down its storefront, over a million legitimate devices with locked bootloaders were stripped of any right to repair—consigned straight to landfill e-waste.

### Clearing Up Three Tangential Questions Around Other Streaming Hardware

As news of the takedown spread, owners of other popular streaming boxes and smart TVs raised urgent questions about whether their living rooms were caught in the blast radius. Primary regulatory filings and forensic IoC lists settle the three most common concerns:

1. **Is Videostrong behind the `X96 Max` boxes notorious for saturating home upload bandwidth?** No—different manufacturer entirely. Original U.S. FCC equipment authorization filings show that genuine `X96 Max` units (along with `X96 Mini` and `X96 X4`) are built by **Shenzhen Amediatech Technology Co., Ltd. ([FCC Grantee Code `2AI6D`](https://fccid.io/2AI6D-X96MAX/User-Manual/15-X96-Max-UserMan-4104889))**, which shares no corporate ownership with Videostrong (`2AGKB`) and does not appear on Synthient's 188-model XCPE list. That said, off-brand AOSP boxes quietly bundling commercial PCDN daemons via OTA updates or repacked ROMs—spiking outbound NAT connection tables into the tens of thousands—remains a parallel plague across the exact same Shenzhen export ecosystem.
2. **Are Apple TV, mainstream domestic Chinese retail boxes, carrier IPTV terminals, or Phicomm N1 units affected?** Closed-ecosystem Apple TV hardware, unmodified retail streaming boxes sold for the Chinese domestic market (Xiaomi Mi Box, Tmall MagicBox, Dangbei, Tencent Aurora), and stock carrier-issued IPTV set-top boxes are unaffected by XCPE. **The sole trap lies in secondhand custom ROMs**: Synthient's confirmed infection list includes common domestic carrier hardware model **`E900V22C`** alongside `TX3MINI`, because certain secondhand-market "unlock ROMs" converting carrier boxes into native Android TV units lifted system partitions directly from Amlogic-based MECOOL firmware—porting the backdoor intact. Likewise, a Phicomm N1 running transparently built community OpenWrt, Armbian, or CoreELEC is clean, whereas any unit flashed with a mystery MECOOL Android TV port must be audited immediately.
3. **How does the recent "Samsung smart TV screenshot and soundbar listening" controversy relate to this?** That involves a separate smart-screen privacy battle that erupted in October 2026. On October 6, plaintiffs filed a federal class-action complaint in the Northern District of California (*Tillery v. Samsung*, [Case No. `3:26-cv-11448`](https://www.claimdepot.com/cases/samsung-smart-tv-lawsuit-alleges-secret-acr-surveillance-of-73-million-viewers)) alleging Samsung's Automatic Content Recognition (ACR) captures screen frames roughly twice per second—even across external HDMI PCs and game consoles—affecting some 73 million U.S. viewers; late in October, a reverse engineer further claimed 2025 Tizen firmware on mic-free Samsung TVs actively probes for external soundbar microphones ([Malwarebytes noted](https://www.malwarebytes.com/blog/privacy/2026/10/samsung-tvs-without-mics-may-listen-through-soundbars-researcher-says) that this single-source teardown awaits independent third-party reproduction). Though rooted in aggressive corporate telemetry rather than criminal proxy botnets, it reinforces how hostile living-room screens have become to household privacy.

### A Four-Step Root-Free Triage Guide for Home Networks

If you run an imported Android TV box, cross-border streaming stick, or secondhand box flashed with a ported ROM, you do not need hardware disassembly or root access to check for XCPE. Enabling Developer Options to connect `adb` over your LAN alongside your router's query log will tell you within five minutes whether the hardware is compromised:

```bash
# 1. Check the device model string and MECOOL-specific build property (any MECOOL flag or match on the 188-model list is high risk)
adb shell getprop ro.product.model
adb shell getprop ro.mecool.device

# 2. Scan read-only firmware and system package paths for known XCPE backdoor and loader package names
adb shell "pm list packages -f | grep -Ei 'x\.cpe|oemservice|abc\.nexus|vs\.grass|system\.ntp|sso\.auth|vsota|debugtools'"

# 3. Inspect the global Google Play Protect verification toggle (a -1 value when never manually disabled indicates tampering)
adb shell settings get global package_verifier_user_consent
```

Step four happens on your router, OpenWrt gateway, AdGuard Home, or Pi-hole: search DNS and firewall logs from the box's LAN IP for recurring queries to `*.anyevonline.com`, `*.szbboys.com`, `*.yokatvonline.com`, `webnest.columbus2024.com`, `webnest.linkfog.cn`, or `connect.sdk.absolut.fit`, as well as outbound TCP connection attempts on ports `3885–3887`. Even with the primary domains frozen in `clientHold` returning `NXDOMAIN`, the dormant stub keeps beaconing on schedule. If any single check comes back positive, pull the power cord and ethernet cable for good—blocking known domains on a firewall while leaving a vendor-signed rootkit inside your LAN is a gamble no household needs to take.

## When a Backdoor-Planting ODM Pivots to Camera-Equipped AI Companion Robots

Had this saga ended with a shuttered MECOOL webstore and a million bricked streaming boxes, it might have gone down as just another cautionary tale of a legacy set-top box ODM burning its own house down. What makes the story genuinely chilling is the new corporate identity Videostrong is now pitching to global brands.

![Archived screenshot of Videostrong Technology's English homepage captured by Synthient, featuring a multi-generational family gathered around a purple two-wheeled AI pet robot under the headline Your One-Stop AI Companion Robot OEM/ODM Partner](https://afengblog.com/uploads/2026/11/1a9f2519ba832357e02008af.webp "Figure 7 · Videostrong's corporate portal has pivoted its hero branding to a one-stop OEM and ODM partner for AI pet, family, and elderly-care companion robots (Source — Synthient archive / Videostrong.com)")

Open [Videostrong's Chinese portal](https://www.videostrong.com/cn) or English homepage today and TV boxes have been relegated to secondary menus; the hero banner now proclaims **"Your One-Stop AI Companion Robot OEM/ODM Partner"** for custom pet, family, and elderly-care robots. Public patent filings show the company secured a Chinese invention patent in August 2025 for *[A Health Monitoring Method Based on an Elderly-Care Robot and Its Elderly-Care Robot](https://www.163.com/dy/article/K7143D870519QIKK.html)* (`CN118969200B`), and its current white-label catalog features the [`PCR03` wheeled AI pet companion robot](https://www.videostrong.com/products-show/PCR03-ai-pet-robot) equipped with a 1080P infrared night-vision camera and autonomous whole-home patrol monitoring, an 8-core RISC-V bionic robot dog, an Espressif `ESP32-S3` desktop voice companion wired into cloud LLMs, and the `VS-DX5` edge AI board powered by Horizon Robotics' 10-TOPS Sunrise 5 chip.

Precision matters here: as of November 3, 2026, no independent security lab has published a binary teardown detecting XCPE or any other implant inside Videostrong's 2026 `PCR03` mobile pet robot or its non-Android `ESP32-S3` desktop companion, and we cannot equate those newer robot lines with confirmed infected hardware in the absence of binary evidence.

Yet documented in black and white inside primary forensic repositories is an unmistakable warning sign: Videostrong's previously shipped smart elderly-care telehealth gateway **[`HC1` (`AI Home Care Hub`)](https://www.videostrong.com/products-show/hc1-home-care-hub)**—a medical hub built to link seniors' blood-pressure cuffs, glucose meters, and fall-detection radars with television-based remote doctor consultations—alongside its **[`KA2` (`MECOOL NOW`)](https://www.videostrong.com/products-show/Camera-Smart-Box-KA2)** video-calling set-top box packing a 100-degree wide-angle HD camera and a 5-meter far-field dual-microphone array, **both appear explicitly on Synthient's confirmed XCPE infection list**. Those two models substantiate the quiet warning buried in the opening lines of GTIG's report: beyond set-top boxes, the backdoor was also built into "telehealth devices, karaoke machines, and digital signage."

Yesterday, a backdoored streaming box tucked behind a living-room TV meant unwittingly relaying online banking heists, leaking television screenshots, or exposing nearby Wi-Fi BSSIDs. Today, the exact same ODM supply chain that spent six years treating factory firmware as a covert post-sale rent collector is fitting 1080P night-vision cameras, far-field microphone arrays, and autonomous wheeled chassis onto white-label hardware bound for seniors' bedrooms and children's playrooms.

The collapse of Videostrong's 1.47-million-device certified empire strips away the last comforting illusion for smart-home buyers and downstream hardware brands alike. An official certification badge on the retail box cannot police what an OEM signs into read-only `/oem/`, and an eFuse-locked bootloader cannot rescue buyers when the manufacturer itself is the attacker. For brands sourcing ODM hardware, independent pre-delivery binary firmware audits and outbound network baselining are now existential requirements. And for ordinary households, never let streaming boxes, budget IP cameras, or unfamiliar AI companion gadgets share a flat LAN with your laptops, phones, and NAS—spending three minutes on your router to cage them inside a strictly isolated guest VLAN remains the cheapest, sturdiest line of defense left in an era when the backdoor ships from the factory.

Tags: [Cybersecurity](https://afengblog.com/en/tag/cybersecurity), [Engineering Retrospective](https://afengblog.com/en/tag/retrospective), [Supply Chain Security](https://afengblog.com/en/tag/supply-chain-security), [Android TV](https://afengblog.com/en/tag/android-tv), [Botnet](https://afengblog.com/en/tag/botnet)

---

Canonical URL: https://afengblog.com/en/blog/google-certified-xcpe-botnet-videostrong-android-tv.html

Other public pages also provide Markdown by appending `.md`; site index: https://afengblog.com/en/llms.txt