Google announced today that it, alongside a coalition of industry partners, has dismantled a large‑scale botnet built from over 1.3 million Android TV set‑top boxes. The network, identified as “XCPE,” was used to rent users’ Internet connections to strangers, fuel advertising fraud and support other criminal activities.
How the XCPE botnet operated
The botnet was traced to Videostrong Technology Co., a Chinese manufacturer of TV boxes. According to the Google Threat Intelligence Group (GTIG), Videostrong embedded malicious code in the devices that automatically activated when a user powered the box on for the first time. Once infected, the devices were enrolled in the XCPE network and turned into “residential proxies.” These proxies allowed third‑party services to sell the IP addresses of ordinary homes, enabling customers to mask their true location or disguise web traffic.
Residential proxy services are a known source of illicit activity, including account takeover, advertising fraud and mass content scraping for artificial‑intelligence training. GTIG’s report notes that the XCSE malware was also discovered in other Android‑based Internet of Things (IoT) products, such as telehealth devices, karaoke machines and digital signage systems.
Legal action and industry response
Google took legal steps to shut down the domains and servers that Videostrong used to control the botnet and distribute additional malware. The company also severed all ties with Videostrong, describing the manufacturer’s deliberate infection of consumer devices as “an unacceptable breach of trust.”
Several residential‑proxy providers were named in the GTIG report as having their software development kits downloaded by infected devices. These include AppSalt (also known as Honeygain), owned by Lithuania‑based Oxylabs, which was rebranded as Source after a $130 million private‑equity investment that valued the business at $3.6 billion. Oxylabs did not comment on the matter.
NetNut, a proxy service operated by Israeli publicly‑traded Alarum Technologies, was also linked to the botnet. In July 2026, the FBI seized hundreds of NetNut‑related domains, alleging the company ran a separate botnet called Popa that similarly enslaved TV boxes. Other providers cited were EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb and GaGaNode.
Synthient, a startup that tracks proxy providers, was credited as a key partner in the takedown. Earlier research by Synthient on the Kimwolf botnet helped force many proxy operators to patch their networks, reducing the scale of that botnet’s disruptive DDoS attacks. The Motion Picture Association later partnered with Synthient to purchase and dismantle a range of infected Android TV boxes.
Wider IoT implications and expert commentary
The GTIG estimate suggests the XCPE takedown will cut off access to at least 10 million additional compromised devices beyond the original 1.3 million TV boxes. Synthient founder Ben Brundage called the 1.3 million figure “highly conservative,” noting that the true number of affected devices is likely much larger.
Brundage also confirmed that Videostrong’s malware distributed software for the proxy service Grass. Earlier reporting in November 2025 had linked the popular Superbox streaming device to Grass’s residential proxy code, though Grass’s founder denied any partnership with the device maker.
Marketing for these devices often relies on influencers on platforms like TikTok, who promote the boxes as a way to access hundreds of pirated streaming channels for a one‑time fee. The MECOOL brand, sold by Skyworth Technology, saw a surge in sales after a 2023 video by the YouTube channel Linux Tech Tips, which now labels the product as a scam and has removed affiliate links.
Google reiterated its requirement that all Android device manufacturers pass strict compatibility and security tests. While Videostrong found a way to bypass those safeguards, Google says the vulnerability has been addressed.
The coordinated effort marks one of the largest known operations against back‑doored TV boxes, and industry observers expect further scrutiny of IoT devices that may be co‑opted into similar proxy‑based botnets.
Norman Pearlstine is the Executive Editor and Co-Founder at News Raise. With over two decades of experience across financial journalism, corporate governance, and market analysis, Norman leads the editorial direction and ensures strict adherence to journalistic accuracy and ethics.
