The Internals of a Badbox Operation

This report was produced in partnership with the Motion Picture Association (MPA) and in coordination with Google, Plume, Trend Micro, Lumen, and HUMAN Security, as part of Synthient’s ongoing investigation into BadBox-type devices. This report focuses on MECOOL, a pre-infected set-top box that has dominated the consumer market since early 2020. Through this investigation, Synthient’s Research Team was able to uncover a massive campaign involving over 1.3 million compromised devices, operating as part of a larger pay-per-install (PPI) campaign. This operation has had a significant impact, helping to fuel the ad fraud and proxy ecosystem.

Through this research, Synthient’s Research Team was able to attribute MECOOL to Videostrong Technology Co., Ltd., a China-based device manufacturer that has maintained the development of “x.cpe,” a backdoor that grants the operators persistent device access for deploying additional payloads including, but not limited to, AdMoyu, Appsalt (Honeygain), and APSolo. As a result of these findings, Google has cut ties with Videostrong and permanently banned the company, along with any of its future subsidiaries or affiliates, from building and selling certified Android devices or supplying software to other certified vendors.

Synthient’s Research Team recommends that these devices be immediately pulled from online retail stores and marketplaces. Consumers are also advised to permanently dispose of these devices, as they pose a high risk of containing additional malware. Organizations should block the full list of indicators and observables in the Indicators of Compromise section of Synthient’s public research repository.

In early January during the Kimwolf campaign, Synthient’s Research Team observed various Badbox devices being infected by Kimwolf. Synthient’s Research Team, in partnership with the Motion Picture Association (MPA), subsequently purchased a number of these devices for further analysis using data collected from infected hardware. This included devices sold under the MECOOL brand.

MECOOL

Operating since early 2022, MECOOL is an online storefront that sells a wide range of Android-based devices, including smart projectors, TVs, and set-top boxes. These devices have gained popularity in the consumer market, especially for piracy, allowing users to install third-party apps to circumvent DRM.

The MECOOL brand has been endorsed for its piracy features by high-profile content creators, including the YouTube channel Linus Tech Tips, which holds an audience of over 16.8 million subscribers. These endorsements have helped it gain popularity and make the storefront appear to be a legitimate company.

KM9PRO

Synthient’s Research Team acquired a MECOOL KM9PRO Max in late 2025. The device specifications are available in Synthient’s public research repository. Root access was achieved by enabling developer mode in settings and connecting to the device over ADB (port 5555). From there, all running applications and processes were dumped for analysis.

The KM9PRO comes pre-installed with a backdoor running under the name “com.oemservice” (hereafter referred to as “x.cpe”). Signed by Skyworth Digital Technology, the backdoor grants operators system-level privileges, allowing for everything from remote code execution to file management.

Upon boot, com.oemservice sends the device information to extstb[.]anyevonline[.]com. The server responds with MQTT credentials for the message broker, which is used to distribute tasks to infected devices. At the time of publication, the message broker is mqtt[.]szbboys[.]com (219[.]134[.]163[.]210) which enables connections on ports 3885, 3886, and 3887.

Upon connection to the MQTT broker, the device sends a heartbeat message, which includes device information in addition to the user's email address if logged in. The device then listens for incoming tasks such as installing and removing applications. During this period, Synthient’s Research Team observed payloads being distributed from the GitHub repository github[.]com/Aviciiii/ott, which contains a trove of files ranging from device images to backdoors.

These payloads follow the structure shown below, with a region field allowing for geo-targeting of installs, along with a list of apps to infect the device with.

The following module codes are observed being pushed through the MQTT broker:

For brevity, we have chosen not to document all of the modules installed by x.cpe. For a full list, please refer to the report published by Google. Synthient’s Research Team has already written about several of these malware families, with reports linked below:

• IPWeb // APSolo // BWM
• Gaganode // IPCola

Nexus

One of the core apps observed being distributed is referred to as Nexus. Nexus acts as a bundler which packages multiple malware strains into one centralized app.

During its development, Nexus received a series of updates, adding and removing various proxy SDKs. Leveraging VirusTotal, Synthient’s Research Team was able to document the following versions.

Returning to the C2 server anyevonline[.]com, we can pivot to the subdomain, file.anyevonline[.]com:8000, which has a publicly accessible open directory. This directory contains the backdoors leveraged by the operators, alongside a directory titled “pdf”.

Navigating to this directory, we are presented with a signed document by Owen Cao, the R&D Director of Videostrong Technology Co.

Furthermore, the domain videostrong[.]cn points to the same IP address as mqtt[.]anyevonline[.]com, which is the main administrator panel for operators. This panel grants operators the ability to see victims, deploy tasks, and manage app installs. Additionally, numerous Videostrong email addresses were observed signing the backdoors.

Videostrong markets itself as a “leader” in AI robotics offering AI companion robots, TV Boxes, and Smartspeakers.

Synthient’s Research Team assesses with high confidence that Videostrong Technology Co., Ltd. is the operator behind this campaign. This campaign spans numerous front-facing stores, including yokatv[.]com, with these devices all packaging the x.cpe backdoor.

Synthient’s Research Team was able to map out a nearly complete picture of Videostrong, providing insights into the full scale of the operation. Synthient’s Research Team conservatively estimates there to be at least 1.3 million backdoored devices, with around half a million actively online. These findings show a strong presence in Malaysia, Mexico, and Brazil, with victims in other notable countries, including the United States, China, and Germany.

Organizations

• Audit and Remove: Inspect your network for MECOOL or similar devices using the report’s IOCs; immediately disconnect and dispose of any found.
• Block Malicious Infrastructure: Proactively block all C2 domains and IPs outlined in this report.
• Isolate IoT Devices: Place remaining IoT devices on segmented networks, isolated from sensitive systems.

Victims

• Identify & Disconnect: Examine all smart devices on your home network; immediately unplug any unknown or suspicious devices.
• Check for Proxy Use: Use online services to confirm your IP address isn’t being misused as a residential proxy.
• Update and Secure: Change Wi-Fi passwords and update router and device firmware to reduce the risk of reinfection.

Through its investigation into MECOOL, Synthient’s Research Team uncovered a massive supply chain compromise traced directly to Videostrong Technology Co., Ltd. Using obfuscation techniques to evade pre-release security tests, the manufacturer embedded the x.cpe backdoor into the device firmware, creating a persistent MQTT network that silently pulls down secondary payloads. As a result, Google has implemented changes to its existing review process to better safeguard against similar activity in the future. These payloads have directly helped residential proxies and ad fraud SDKs flourish. Synthient’s Research Team estimates there are at least 1.3 million compromised devices globally, with roughly half a million communicating daily with backend servers. Illicit pay-per-install networks provide a substantial backbone to the broader fraud ecosystem, powering everything from direct ad fraud to unregulated proxy networks that push credential stuffing and DDoS botnets.

This research has been published in partnership with the Motion Picture Association (MPA). As the MPA’s Executive VP and Chief Content Protection Officer Larissa Knapp noted, “Illicit streaming devices and applications can expose consumers to serious cybersecurity risks, including malware, identity theft, and financial fraud. What may seem like an inexpensive way to access entertainment can come at a significant personal cost. Research like this reinforces why protecting consumers is an essential part of our efforts to combat digital piracy.”

Additional partners in this research include Google, Plume, Trend Micro, Lumen, and HUMAN Security. Related partner reports can be found below:

• Google
• Plume
• TrendAI™
• Lumen

The complete indicators of compromise and observables, including file hashes, certificate fingerprints, network infrastructure, SDK identifiers, and affected device models, are available in Synthient’s public research repository on GitHub.