A large-scale supply chain compromise affected MECOOL Android set-top boxes manufactured by Videostrong Technology Co., Ltd. Over 1.3 million devices were pre-infected with the x.cpe backdoor, enabling system-level access via MQTT infrastructure. The backdoor deploys multiple payloads including residential proxy SDKs and various ad fraud modules. Approximately 500,000 infected devices remain active, primarily in Malaysia, Mexico, and Brazil. The operation supports a pay-per-install campaign that fuels ad fraud and proxy ecosystems. Google has permanently banned Videostrong from the Android ecosystem due to this compromise.
