The Internals of a Badbox Operation

A large-scale supply chain compromise affected MECOOL Android set-top boxes manufactured by Videostrong Technology Co., Ltd. Over 1.3 million devices were pre-infected with the x.cpe backdoor, enabling system-level access via MQTT infrastructure. The backdoor deploys multiple payloads including residential proxy SDKs and various ad fraud modules. Approximately 500,000 infected devices remain active, primarily in Malaysia, Mexico, and Brazil. The operation supports a pay-per-install campaign that fuels ad fraud and proxy ecosystems. Google has permanently banned Videostrong from the Android ecosystem due to this compromise.

• Shutting the Door on the XCPE BotnetMalware2026-11-02
• Midnight Mimosa Malware Campaign Exploits Android Firmware Supply ChainMalware2026-10-20
• The phone was compromised before the user turned it on: the rise of Midnight MimosaMalware2026-10-12
• The tablet conqueror and the links between major Android botnetsMalware2026-02-17
• Trojanized Claude Code Extension Plants an SSH BackdoorCampaign2026-10-30