Collaboration Leads to Dismantling of XCPE Botnet Targeting Android TV Boxes
Google announced on November 3, 2026, that it has collaborated with industry partners to dismantle a botnet consisting of over 1.3 million Android TV set-top boxes infected with malware that exploited users’ internet connections for advertising fraud. Experts believe this action could cut off access to over 10 million additional compromised devices, including various Internet of Things (IoT) products.
A report from the Google Threat Intelligence Group (GTIG) revealed that Google severed ties with Videostrong Technology Co., a Chinese manufacturer responsible for embedding malware into these devices, creating the botnet named “XCPE.” The XCPE botnet allowed infected devices to sell their internet addresses through “residential proxy” services, which are often used for malicious activities such as account takeovers and advertising fraud.
According to the GTIG post, “Videostrong monetized the backdoor by selling access to criminal affiliates.” Google has initiated legal action to dismantle the domains and servers used by Videostrong to control the botnet. This breach of trust poses significant risks to users.
While the majority of the botnet consisted of TV boxes, the XCPE malware was also found in other Android-based IoT products, including telehealth devices and karaoke machines. Google mandates that all Android device manufacturers pass security tests, but Videostrong managed to load its malware immediately upon device startup, a vulnerability that has since been addressed.
The GTIG report identified several residential proxy providers linked to the XCPE botnet, including AppSalt, also known as Honeygain, owned by Oxylabs, which was rebranded as Source after receiving $130 million in funding. Another provider, NetNut, was previously operated by Alarum Technologies, which the FBI targeted in July 2026 for operating a separate botnet.
Google’s announcement credited several industry partners, including Synthient, a startup tracking proxy providers. Synthient previously published research on the Kimwolf botnet, which infected millions of Android set-top boxes, prompting numerous proxy providers to patch their networks and fragment the botnet.
Synthient’s findings attracted the attention of the Motion Picture Association (MPA), which partnered with Synthient to investigate and dismantle several popular Android TV set-top boxes, including those infected by Kimwolf. A report from Synthient noted that the MECOOL brand, sold by Skyworth Technology, also bundled malware from Videostrong.
Synthient founder Ben Brundage indicated that Videostrong’s malware also distributed software for the proxy service Grass. The popular Superbox TV streaming device was reported to include Grass’s residential proxy software. The founder of Grass denied any affiliation with the TV box manufacturer.
The GTIG report estimates that dismantling the XCPE botnet will sever access to at least 10 million additional compromised devices, noting that Videostrong’s affiliates have diversified their distribution channels. Synthient’s Brundage stated that the 1.3 million figure is likely “highly conservative,” suggesting that the scale of affected devices is much higher, marking this as one of the largest operations against compromised TV boxes to date.
Source: Krebs on Security