In a significant victory for global cybersecurity, Google announced today that it has successfully worked alongside industry partners to dismantle a sprawling botnet composed of more than 1.3 million compromised Android TV set-top boxes. These devices, which ship to consumers with pre-installed malicious software, have been surreptitiously renting out user internet connections to anonymous strangers while facilitating widespread advertising fraud. Security researchers involved in the operation have warned that this takedown is only the beginning, as the infrastructure severed in this action likely disrupts access to more than 10 million additional compromised systems, ranging from Android-based healthcare equipment to digital signage and karaoke machines.
The operation centered on the “XCPE” botnet, a sophisticated network named after one of the malware’s primary code components. A comprehensive report published by the Google Threat Intelligence Group (GTIG) identified the source of the infection as Videostrong Technology Co., a manufacturer based in China. Following an exhaustive investigation, GTIG and other industry experts concluded that Videostrong was responsible for embedding the malicious code directly into the firmware of their set-top boxes, effectively enrolling unsuspecting consumers into a global criminal network the moment they plugged in their new devices.
The Mechanism of Exploitation
The XCPE botnet functioned by transforming ordinary home entertainment devices into silent, high-traffic relay points. Once active, the malware loaded software onto the TV boxes that effectively hijacked the user’s internet connection. This bandwidth was then sold to various “residential proxy” services, which allow third-party customers to rent IP addresses to anonymize their web traffic, bypass geographic restrictions, or obscure their true location.
While the concept of residential proxies is sometimes used for legitimate research, they have increasingly become a primary engine for malicious activity. According to long-standing security observations, these services are frequently leveraged for account takeover attacks, sophisticated advertising fraud, and massive data scraping operations intended to feed artificial intelligence projects.
“Videostrong monetized the backdoor by selling access to criminal affiliates and loading those affiliates’ malware modules onto infected devices,” the GTIG report stated. Google’s legal and technical teams acted to seize the domains and servers that Videostrong utilized to maintain control over the botnet and push secondary malware payloads. In a firm condemnation of the practice, Google noted that a manufacturer intentionally compromising their own users represents a gross breach of consumer trust and poses a severe, systemic risk to global network security.
Beyond the Living Room
While the initial focus of the investigation was on Android TV boxes, the reach of the XCPE malware was far broader than initially anticipated. Investigators discovered that the same malicious code was present in a variety of other Android-based Internet of Things (IoT) hardware. This included specialized telehealth devices, which could potentially expose sensitive patient data, as well as commercial-grade karaoke machines and digital signage systems found in public spaces.
Google maintains strict security and compatibility standards for all Android device manufacturers, requiring them to pass rigorous testing to ensure their products do not pose a threat to the ecosystem. Despite these safeguards, Videostrong managed to circumvent these protocols by loading the malicious software to execute immediately upon the device’s first boot-up. Google officials have confirmed that they have since addressed the specific technical vulnerability that allowed this bypass to occur.
A Web of Proxy Providers
The GTIG investigation shed light on the broader, murky ecosystem of residential proxy providers that were eager to purchase access to the infected devices. Among the entities identified as having their software development kits (SDKs) routinely downloaded by infected XCPE devices was AppSalt, also known as Honeygain, a brand owned by the Vilnius, Lithuania-based company Oxylabs.
In a notable shift in the corporate landscape, Oxylabs was rebranded as “Source” in October 2026, following a $130 million funding round from private equity firm Warburg Pincus, which reportedly placed the company’s valuation at $3.6 billion. Despite the scale of these operations, Oxylabs did not provide a comment when requested.
Another prominent name appearing in the report is NetNut, a residential proxy provider operated by the publicly traded Israeli company Alarum Technologies. The FBI and various industry partners had previously intervened in July 2026, seizing hundreds of domains associated with NetNut after linking the company to a separate, massive botnet dubbed “Popa,” which also enslaved TV boxes for use as proxy nodes. The list of other providers named in the GTIG findings as having ties to the XCPE-infected ecosystem includes EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb, and GaGaNode.
Tracking the Spread: The Role of Synthient
The successful disruption of the XCPE botnet was a collaborative effort involving several key industry players, including the security startup Synthient. The firm has been at the forefront of tracking the evolution of proxy-based botnets. In January 2026, Synthient released groundbreaking research on the “Kimwolf” botnet, which had been responsible for launching record-shattering Distributed Denial of Service (DDoS) attacks against ISPs across the globe.
Synthient’s research revealed that Kimwolf utilized vulnerabilities in residential proxy services to compromise not just the TV boxes themselves, but other IoT devices located within the same local networks. By documenting these infection paths, Synthient enabled proxy providers to patch their networks, effectively fracturing the Kimwolf botnet and making the resulting DDoS attacks significantly easier for network operators to mitigate.
This research eventually drew the interest of the Motion Picture Association (MPA), which partnered with Synthient to conduct forensic teardowns of various popular Android TV boxes. In a report published concurrently with Google’s announcement, Synthient examined devices sold under the MECOOL brand by the Chinese company Skyworth Technology. The analysis concluded that MECOOL boxes were also bundling Videostrong’s malware, along with components for the AppSalt/Honeygain proxy service.
Influencer Marketing and the Scam Economy
The growth of these botnets is intrinsically linked to a modern marketing phenomenon: social media influencers. Many of these infected TV boxes—such as the Superbox or MECOOL models—are marketed on platforms like TikTok and YouTube as convenient, one-time-fee solutions for accessing hundreds of pirated premium TV channels.
The popularity of MECOOL, for instance, was supercharged in 2023 by a recommendation from the prominent YouTube channel Linus Tech Tips, which boasts an audience of nearly 17 million subscribers. Following the revelation of the security risks, the channel issued a statement confirming it had updated the original video to explicitly identify the product as a scam and removed all associated affiliate links.
The Path Forward
The GTIG report estimates that while the immediate takedown addressed 1.3 million devices, the total impact of the operation is likely much greater. Because the proxy and ad-fraud affiliates utilized by manufacturers like Videostrong often maintain diversified distribution channels for their modules, the takedown of the central XCPE infrastructure is expected to sever access to at least 10 million additional compromised devices.
Ben Brundage, founder of Synthient, described the 1.3 million figure as a “highly conservative” estimate of the damage. “The scale of affected devices is likely way higher,” Brundage noted in his assessment. “This is probably the largest operation against backdoored TV boxes that we’ve seen.”
As the industry grapples with the aftermath, security experts are urging users to be wary of low-cost, unbranded, or “fully loaded” streaming boxes sold through non-traditional retail channels. The incident serves as a stark reminder that in the interconnected age, a device that seems too good to be true often carries a hidden cost that goes far beyond the initial purchase price—a cost paid in the loss of digital privacy and the compromise of one’s home network security. For those concerned about the security of their own devices, additional resources, including white papers from Plume Security Labs and technical analyses from TrendAI, continue to provide critical guidance on identifying and mitigating these persistent threats.
