Google worked with industry partners to dismantle a botnet of more than 1.3 million Android TV set-top boxes that shipped with malicious software renting out internet connections and conducting ad fraud, krebsonsecurity.com reported.
The XCPE Infection Chain
The Google Threat Intelligence Group reported that Google severed ties with Videostrong Technology Co., a China-based TV box manufacturer. Videostrong embedded malware enrolling devices into the XCPE botnet. The XCPE code forced infected hardware to serve as residential proxies.
Residential proxy services resell internet addresses to let customers anonymize web traffic or spoof locations. Google stated that Videostrong monetized the backdoor by selling access to criminal affiliates. These affiliates loaded additional malware modules onto compromised hardware.
The XCPE malware spread beyond standard television boxes. Investigators found the same code inside Android-based telehealth devices, digital signage systems, and karaoke machines. Google noted that while Android device makers must pass security tests, Videostrong deployed the malware immediately upon first boot, a weakness Google has since addressed.
GTIG Report Links Proxy Providers to XCPE-Infected Hardware
The GTIG report linked several residential proxy providers to software development kits downloaded by XCPE-infected hardware. AppSalt, also known as Honeygain, was developed by Oxylabs based in Vilnius, Lithuania. Oxylabs and Honeygain reorganized under an umbrella entity called Source in October 2026 after receiving $130 million from private equity firm Warburg Pincus, valuing the business at $3.6 billion, krebsonsecurity.com reported.
Google just disrupted the XCPE Android TV box botnet and banned maker Videostrong. Here's what you need to know. The XCPE botnet hid in more than 1.3 million Android TV set-top boxes across 200 countries. Google says it has high confidence that Shenzhen device maker Videostrong… https://t.co/zsh8FOUery pic.twitter.com/RF0sBHUd40
Oxylabs stated post-publication that while its system is designed to require user consent before using a device as a proxy exit node, the developer faked those signals. We have been conducting regular audits of the applications provided by our partners,
Oxylabs said in a statement.
However, following this incident, we will improve the application and application’s build fingerprinting logic to better detect cases where the SDK is running on an unapproved build of an originally authorized application.
As soon as we saw that, we suspended the relationship and sent them a formal legal inquiry,
Oxylabs stated. This supplier accounts for less than 1% of our IP address pool.
Another proxy provider linked to the activity was NetNut, operated by Alarum Technologies. In July 2026, the FBI seized hundreds of domains associated with NetNut for operating a separate botnet named Popa. Additional proxy providers named in the GTIG report include EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb, and GaGaNode.
Synthient Research Helped Fragment the Kimwolf Botnet
Google credited industry partners including startup Synthient. In January 2026, Synthient published research on the Kimwolf botnet, which hit networks worldwide with DDoS attacks and spread rapidly across Android set-top boxes. Synthient’s findings prompted proxy providers to patch networks, fragmenting Kimwolf.
The Motion Picture Association partnered with Synthient to analyze pre-infected Android TV boxes. Synthient examined a MECOOL-branded TV box sold by Skyworth Technology, finding that it bundled Videostrong malware along with AppSalt and other proxy components.
Synthient founder Ben Brundage stated that Videostrong malware also distributed software for the proxy service Grass. A November 2025 investigation found Superbox TV streaming devices bundled Grass residential proxy software, though the Grass founder denied affiliation with the hardware maker.
Superbox and similar streaming hardware gained traction through social media influencers promoting access to pay TV services for a flat fee. Similarly, MECOOL set-top boxes grew in popularity following a 2023 mention by the YouTube channel Linus Tech Tips. Linus Tech Tips stated it updated the video to frame the product as a scam and removed affiliate links.
Malware found in 1.3 million Google-certified Android TV boxes.https://t.co/vx9qGHnCFm TV box manufacturer Videostrong has been installing the XCPE backdoor on its TV boxes since at least late 2024 in order to allow affiliates to install modules for ad fraud, proxy networks,… pic.twitter.com/AWzy4g562z
Scope of the Takedown
Experts estimate the action will sever access to over 10 million additional compromised systems across various IoT devices. GTIG stated that proxy and ad fraud affiliates maintained diversified distribution channels beyond XCPE.
Ben Brundage called the 1.3 million infection figure highly conservative. The scale of affected devices is likely way higher,
he said, calling it the largest operation against backdoored TV boxes observed to date.
Google Disrupts 1.3 Million-Device Android TV Botnet, Exposing Firmware Security Risks Google has disrupted a botnet involving more than 1.3 million Android set-top boxes, exposing a security risk that goes beyond malicious apps: a backdoor embedded in device firmware. Google's… pic.twitter.com/CTCAGq9F66
