Google said today it worked with industry partners to dismantle a botnet consisting of more than 1.3 million Android TV set-top boxes come with malware that secretly rents the user’s Internet connection to strangers and practices ad fraud. Experts involved in the takedown say the action is likely to cut off the botnet’s access to more than 10 million additional compromised systems, including other Internet of Things (IoT) products such as Android-based healthcare devices and karaoke machines.
A report from Google Threat Intelligence Group (GTIG) said Google had severed ties with Videostrong Technology Co.a TV box maker in China that GTIG and other industry experts concluded was responsible for including malware that enlisted more than 1.3 million set-top boxes in a botnet dubbed “XCPE» (named after one of the main components of the malware code).
The global distribution of XCPE botnet infections. Image: Google Threat Intelligence Group.
The report states that the XCPE botnet loaded the user’s device with software that made their Internet address available for resale by several “residential proxy” services, which allow customers to rent Internet addresses in order to anonymize their web traffic or spoof their true location. As detailed in several articles here over the last year, residential proxy services are a major source of unwanted and often malicious traffic, including account takeover activity, ad fraud, and mass content scraping for AI projects.
“Videostrong monetized the backdoor by selling access to criminal affiliates and loading those affiliates’ malicious modules onto infected devices,” the GTIG post read, noting that Google filed a lawsuit to take down the domains and servers Videostrong used to control the botnet and install additional malware. “A device manufacturer intentionally infecting its users with malware constitutes an unacceptable breach of trust and poses a serious risk to those users. Without users’ knowledge or consent, infected devices were offered as a distribution mechanism to a wide range of criminal actors.”
The report notes that although TV boxes made up the majority of the botnet, the same XCPE malware has been found in other Android-based IoT products, including telehealth devices, karaoke machines, and even digital signage systems.
Google said it required all Android device makers to pass compatibility and security tests to ensure their products didn’t harm users, but Videostrong nonetheless found a way to load their malware immediately after a user boots up one of those devices for the first time (Google says it has since fixed this weakness).
The GTIG report exposes a number of residential proxy providers whose SDKs were routinely downloaded by devices infected with the XCPE botnet. These include AppSaltalso known as Honey gainwhich is owned by the company based in Vilnius, Lithuania Oxylabs. In October 2026, Oxylabs was relaunched under a new brand called Sourceafter receiving $130 million in funding from private equity firm Warburg Pincus, which reportedly valued the company at $3.6 billion. Oxylabs did not respond to a request for comment.
Another vendor linked to the botnet was NetNuta once-sprawling residential proxy company operated by the publicly traded Israeli company Alarm technologies. In July 2026, the FBI worked with industry partners to seize hundreds of domains associated with NetNut, claiming that the company was responsible for operating a separate botnet called NetNut. Dad which enslaved TV boxes as residential proxies. Other proxy providers named in the GTIG report include WinFM, Traffic monetizer, Jaguar, LINKFOG, BMW/IPWeb And GaGaNode.
Google’s announcement recognizes a number of industry partners, including Synthienta startup that tracks proxy providers. In January 2026, Synthient published a study on the rapid spread of the virus. Kimloup botnet, which at the time was hammering networks around the world with record-shattering DDoS attacks. Synthient documented how Kimwolf infected millions of Android set-top boxes virtually overnight, using a widespread vulnerability in these residential proxy services to compromise other Android-based devices within the local networks of unsuspecting TV users.
Synthient’s research led dozens of residential proxy providers to patch their networks, which helped fragment the Kimwolf botnet into much smaller pieces, making its relentless and disruptive DDoS attacks much easier for network operators to manage. It also attracted the attention of Cinema Association (MPA), a trade group representing major Hollywood studios, which partnered with Synthient to purchase and take down a number of popular Android TV set-top boxes, some of which were infected with Kimwolf and other IoT botnets.
In a report released today, Synthient examined a popular pre-infected TV box sold under the brand MECOOL by a publicly traded company in China called Skyworth Technologyconcluding that MECOOL also bundled Videostrong Technology Co. malware and also installed AppSalt/Honeygain and other proxy components.
The MECOOL showcase and marketing. Image: Synthient.com.
Founder of Synthient Ben Brundage told KrebsOnSecurity that Videostrong malware also distributed software for the proxy service Grass. In our November 2025 article, “Is your Android TV streaming box part of a botnet? » we quoted a researcher from Censys who found the popular Superbox The TV streaming device bundled Grass’ residential proxy software. We also quoted the founder of Grass, who denied any affiliation with the TV box maker.
This November 2025 article stated that Superbox and similar Android TV set-top boxes gained new customers primarily by engaging influencers on Tiktok and other social networks who praised the product’s ability to offer hundreds of (pirated) pay TV streaming services for a one-time fee.
Similarly, Synthient’s report observes that MECOOL set-top boxes exploded in popularity after the product was mentioned in 2023 by the YouTube channel Linux Tech Tips, which has an audience of nearly 17 million subscribers (Linux Tech Tips said in a statement shared with Synthient that it has since updated the video to explicitly call the product a scam and removed all associated affiliate links).
The popular Youtube channel Linus Tech Tips discusses MECOOL TV streaming boxes.
The GTIG report estimates that taking down the XCPE botnet is expected to cut off access to at least 10 million additional compromised devices, noting that Videostrong’s various ad fraud proxies and affiliates “each have diverse distribution channels for their modules beyond XCPE.”
Synthient’s Brundage echoed that conclusion, calling the 1.3 million figure “highly conservative.”
“The scale of affected devices is probably much higher,” he said. “This is probably the biggest operation against stolen TV boxes that we have seen.”
Further reading:
Plume Security Labs white paper on the XCPE botnet (PDF)
Black Lotus Labs article on LinkedIn
Analysis of TrendAI
Synthient list of affected devices, broken down by model number
Gn tech
