Google dismantles XCPE botnet infecting 1.3 million Android TV boxes

Google announced today that it has worked with industry partners to dismantle a massive botnet composed of more than 1.3 million Android TV set-top boxes. The operation targeted devices manufactured by Videostrong Technology Co., which were shipped with pre-installed malware that secretly rented out users' internet connections. This action is expected to cut off access to over 10 million additional compromised systems across various Internet of Things categories.

What happened

The Google Threat Intelligence Group (GTIG) identified Videostrong Technology Co., a Chinese manufacturer, as the primary actor behind the botnet dubbed "XCPE." The name derives from a core component of the malware embedded in the devices. GTIG concluded that Videostrong intentionally included this malicious software in its hardware, allowing the company to monetize the backdoor by selling access to criminal affiliates. These affiliates then loaded their own malware modules onto the infected devices without user consent or knowledge.

While Android TV boxes constituted the majority of the infection, the XCPE malware was also discovered in other Android-based IoT products. These included telehealth devices, karaoke machines, and digital signage systems. Google stated that while it requires all Android device makers to pass compatibility and security tests, Videostrong managed to load its malicious software immediately upon the first boot of the device. Google noted that it has since addressed the specific weakness that allowed this initial infection vector.

To execute the takedown, Google took legal action to seize the domains and servers Videostrong used to control the botnet and distribute further malware. The report highlights that this was not an isolated incident but part of a broader ecosystem where device manufacturers compromise user trust for profit. The scale of the operation is significant, with experts describing it as likely the largest action taken against backdoored TV boxes to date.

How it works

The XCPE botnet operates by turning infected devices into nodes for residential proxy services. Once a device is compromised, it installs software that makes the user's internet protocol address available for resale. Residential proxy services allow customers to rent these IP addresses to anonymize their web traffic or spoof their geographic location. This infrastructure is frequently used for advertising fraud, account takeovers, and mass content scraping for artificial intelligence projects.

The malware downloaded software development kits from several residential proxy providers directly onto the infected devices. These providers included AppSalt (also known as Honeygain), which is owned by Oxylabs, as well as NetNut, EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb, and GaGaNode. Some of these companies have faced recent scrutiny; for instance, the FBI seized hundreds of domains associated with NetNut in July 2026 due to its involvement in a separate botnet called Popa.

The distribution of these infected devices often relied on social media influence. Brands like MECOOL and Superbox gained popularity through endorsements on platforms like TikTok and YouTube, where influencers promoted their ability to provide pirated streaming services for a one-time fee. For example, MECOOL saw a surge in sales after a mention by the YouTube channel Linus Tech Tips in 2023, although the channel later updated its content to label the product a scam and removed affiliate links.

Key details

• More than 1.3 million Android TV set-top boxes were confirmed as part of the XCPE botnet.
• The takedown is expected to sever access to over 10 million additional compromised IoT devices.
• Videostrong Technology Co. was identified as the manufacturer responsible for pre-installing the malware.
• Infected devices were used to support residential proxy services including AppSalt, NetNut, and Grass.
• The malware also affected Android-based healthcare devices, karaoke machines, and digital signage.
• Google has patched the vulnerability that allowed the malware to load during the initial device boot.

Why it matters

For software engineers and infrastructure leaders, this incident underscores the risks inherent in the supply chain of consumer hardware. When manufacturers intentionally compromise devices, it creates a persistent threat that is difficult to detect and mitigate from the software side alone. The use of these devices for residential proxies means that legitimate traffic from your applications may be intermingled with fraudulent activity, complicating fraud detection and security monitoring efforts.

Furthermore, the reliance on residential proxies for AI data scraping and ad fraud highlights a growing challenge for digital services. As AI projects require vast amounts of data, the demand for anonymized, residential-level access increases. This drives the market for botnets like XCPE, creating a feedback loop where compromised IoT devices become valuable commodities for criminal enterprises. Understanding this dynamic is crucial for building robust defense mechanisms against automated abuse.

What you can do

• Audit your network traffic for unusual patterns that may indicate residential proxy usage.
• Review vendor security practices when sourcing IoT hardware for enterprise or consumer use.
• Implement strict device authentication protocols to prevent unauthorized devices from joining your network.
• Monitor for indicators of compromise associated with known proxy SDKs such as AppSalt or Honeygain.
• Educate users about the risks of purchasing unofficial streaming devices that promise free premium content.
• Stay updated on threat intelligence reports from groups like GTIG and Synthient to identify emerging botnets.