In a significant blow to global cybercriminal operations, Google announced today that it has successfully worked with a coalition of industry partners to dismantle a sprawling botnet known as "XCPE." The network, which consisted of more than 1.3 million compromised Android TV set-top boxes, was engineered by its manufacturer to covertly weaponize the users’ own internet connections. By embedding malicious software directly into the devices at the factory level, the operators were able to turn ordinary living room hardware into silent conduits for advertising fraud and unauthorized data transit.
Experts involved in the takedown operation estimate that this action is far more reaching than the initial 1.3 million devices suggest. By severing the command-and-control infrastructure, the coalition believes they have effectively crippled the botnet’s access to an additional 10 million compromised systems. These include a diverse array of Internet of Things (IoT) products, such as Android-based healthcare devices, digital signage, and karaoke machines, all of which had been integrated into the XCPE ecosystem.
The Role of Videostrong Technology
The investigation, led by the Google Threat Intelligence Group (GTIG), pinpointed the source of the infection to Videostrong Technology Co., a China-based manufacturer of TV streaming boxes. According to Google’s findings, Videostrong deliberately included malware in the device firmware, ensuring that as soon as a user booted up their new purchase, it was automatically enrolled in the XCPE botnet.
The name "XCPE" was derived from one of the core components of the malicious code. Google has since severed all ties with the manufacturer. In its report, the GTIG described the behavior as a profound betrayal of consumer trust. "A device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust and represents a serious risk to those users," the GTIG statement noted. "Without users’ knowledge or consent, infected devices were offered as a distribution mechanism for a wide array of criminal actors."
The malware functioned by turning the infected devices into "residential proxies." In the modern digital economy, residential proxy services allow customers to rent the IP addresses of unsuspecting home internet users. While these services have legitimate use cases, they are frequently abused to anonymize web traffic, facilitate account takeovers, conduct large-scale advertising fraud, and scrape data for AI training models without the device owner’s permission or knowledge.
Monetizing the Backdoor
The GTIG report detailed that Videostrong was not merely an unwitting victim of a security flaw; they were active participants in the monetization of the backdoor. The manufacturer sold access to the infected devices to various criminal affiliates, allowing those third parties to install additional malware modules onto the boxes. Google has taken aggressive legal action to shutter the domains and servers that Videostrong used to maintain control over the botnet and distribute malicious payloads.
While the majority of the infected hardware consisted of TV boxes, the reach of the XCPE malware was broad. The investigation discovered the same underlying infection on telehealth devices and digital signage systems, suggesting that the malware was being deployed across various product lines manufactured by the same entity.
Google noted that it maintains strict compatibility and security requirements for all Android device makers. However, Videostrong managed to circumvent these protocols by loading the malicious software immediately upon the initial device boot-up. Google claims it has since implemented measures to address this specific vulnerability, aiming to prevent similar factory-level infections in the future.
The Ecosystem of Proxy Providers
The GTIG report highlighted several residential proxy providers whose software development kits (SDKs) were consistently found on devices infected by the XCPE botnet. Among those named was AppSalt, also known as Honeygain, a platform developed by the Vilnius-based firm Oxylabs. In October 2026, Oxylabs and Honeygain underwent a corporate reorganization, moving under a new umbrella entity called Source, which recently secured $130 million in funding at a valuation of $3.6 billion.
The report also identified NetNut, a residential proxy operator previously associated with the publicly traded Israeli firm Alarum Technologies. The FBI and industry partners had previously intervened in July 2026 to seize hundreds of domains linked to NetNut, alleging that the company operated the "Popa" botnet, which, like XCPE, specifically targeted TV boxes to facilitate proxy services. Other providers implicated in the GTIG findings include EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb, and GaGaNode.
Industry Collaboration and the ‘BadBox’ Phenomenon
The takedown was bolstered by research from the security startup Synthient, which has been tracking the evolution of proxy-based botnets for months. In January 2026, Synthient released research into the "Kimwolf" botnet, which had gained notoriety for launching massive Distributed Denial of Service (DDoS) attacks. Synthient’s research revealed how Kimwolf used vulnerabilities in residential proxy services to compromise not just the TV boxes, but other IoT devices within the same local network.
This research triggered a chain reaction, forcing many proxy providers to patch their networks and fragmenting the Kimwolf botnet, making it significantly easier for network operators to mitigate the attacks. This activity also caught the attention of the Motion Picture Association (MPA), which collaborated with Synthient to physically disassemble and analyze various Android TV boxes to understand how they were being co-opted.
In a report released today, Synthient highlighted the MECOOL brand, manufactured by the publicly traded Chinese firm Skyworth Technology. The analysis concluded that MECOOL devices were also bundling Videostrong’s malware, along with components from AppSalt/Honeygain and other proxy services.
The popularity of these devices is often fueled by social media influencers on platforms like TikTok and YouTube. Many of these influencers market the boxes as a "one-time fee" solution for accessing hundreds of pirated pay TV streaming services. MECOOL boxes, in particular, saw a massive surge in popularity after being featured by high-profile tech reviewers, such as the YouTube channel Linus Tech Tips. Following the revelation that these products were essentially Trojan horses, Linus Tech Tips updated its content to classify the devices as scams and removed all associated affiliate links.
The Scope of the Threat
Despite the success of the XCPE takedown, experts warn that the problem is systemic. Ben Brundage, the founder of Synthient, described the 1.3 million figure as "highly conservative." He noted that the proxy and ad-fraud affiliates involved in these operations maintain diversified distribution channels, meaning that even if the XCPE infrastructure is dismantled, the malware modules likely persist through other delivery mechanisms. "The scale of affected devices is likely way higher," Brundage said. "This is probably the largest operation against backdoored TV boxes that we’ve seen."
In a statement provided after the publication of the initial report, Oxylabs addressed the findings, stating that its system is designed to require explicit user consent before a device can function as an exit node. The company alleged that the developers of the infected applications had faked these consent signals.
"We have been conducting regular audits of the applications provided by our partners," Oxylabs stated. "However, following this incident, we will improve the application and application’s build fingerprinting logic to better detect cases where the SDK is running on an unapproved build of an originally authorized application."
Oxylabs clarified that it had no direct record of a relationship with Videostrong Technology Co., but it did identify a specific domain—"com.abc[.]nexus"—mentioned in the GTIG report as a supplier. Upon discovering the link to the malware loader, the company suspended the relationship and initiated a legal inquiry. According to Oxylabs, this supplier accounted for less than 1% of their total IP address pool and had previously assured the company’s quality assurance team that all necessary user consents were in place.
As the industry grapples with the fallout of the XCPE botnet, the incident serves as a stark reminder of the security risks inherent in low-cost, unvetted IoT hardware. With millions of devices still potentially vulnerable and the operators behind these botnets constantly evolving their tactics, the battle to secure the home network remains an ongoing, uphill struggle for both security researchers and global tech platforms.
