Google stated at present it labored with trade companions to dismantle a botnet made up of greater than 1.3 million Android TV set-top bins that ship with malicious software program which secretly rents the person’s Web connection out to strangers and conducts promoting fraud. Consultants concerned within the takedown say the motion is more likely to sever the botnet’s entry to greater than 10 million further compromised methods, together with different Web of Issues (IoT) merchandise resembling Android-based healthcare gadgets and karaoke machines.
A report from the Google Menace Intelligence Group (GTIG) stated Google has severed ties with Videostrong Know-how Co., a TV field producer in China that GTIG and different trade specialists concluded was answerable for together with malware that enrolled greater than 1.3 million set-top bins in a botnet dubbed “XCPE” (named after one of many malware’s core code elements).
The worldwide distribution of XCPE botnet infections. Picture: Google Menace Intelligence Group.
The report stated the XCPE botnet loaded the person’s gadget with software program that makes their Web handle obtainable for resale by a number of “residential proxy” providers, which permit prospects to hire Web addresses as a strategy to anonymize their net site visitors or spoof their true location. As detailed in a number of tales right here over the previous 12 months, residential proxy providers are a significant supply of undesirable and sometimes malicious site visitors, together with account takeover exercise, promoting fraud, and mass content material scraping for AI tasks.
“Videostrong monetized the backdoor by promoting entry to legal associates and loading these associates’ malware modules onto contaminated gadgets,” the GTIG submit reads, noting that Google took authorized motion to take down the domains and servers Videostrong used to manage the botnet and set up further malware. “A tool producer deliberately infecting their customers with malware is an unacceptable breach of belief, and represents a severe threat to these customers. With out customers’ information or consent, contaminated gadgets have been supplied as a distribution mechanism for a big selection of legal actors.”
The report notes that whereas TV bins made up the nearly all of the botnet, the identical XCPE malware was present in different Android-based IoT merchandise, together with telehealth gadgets, karaoke machines, and even digital signage methods.
Google stated it requires all Android gadget makers to cross compatibility and safety assessments to make sure their merchandise don’t hurt customers, however that Videostrong however discovered a strategy to load their malicious software program instantly after a person boots up certainly one of these gadgets for the primary time (Google says it has since addressed that weak point).
The GTIG report calls out numerous residential proxy suppliers whose software program improvement kits have been routinely downloaded by gadgets contaminated by the XCPE botnet. These embrace AppSalt, also referred to as Honeygain, which is owned by the Vilnius, Lithuania-based Oxylabs. In October 2026, Oxylabs was relaunched underneath a brand new model known as Supply, after receiving $130 million in funding from non-public fairness agency Warburg Pincus that reportedly valued the enterprise at $3.6 billion. Oxylabs didn’t reply to a request for remark.
One other supplier linked to the botnet was NetNut, a as soon as sprawling residential proxy firm operated by the publicly-traded Israeli firm Alarum Applied sciences. In July 2026, the FBI labored with trade companions to grab a whole bunch of domains related to NetNut, saying the corporate was answerable for working a separate botnet known as Popa that enslaved TV bins as residential proxies. Different proxy suppliers named within the GTIG report embrace EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb and GaGaNode.
Google’s announcement credit numerous trade companions, together with Synthient, a startup that tracks proxy suppliers. In January 2026, Synthient revealed analysis into the speedy unfold of the Kimwolf botnet, which on the time was hammering networks worldwide with record-smashing DDoS assaults. Synthient documented how Kimwolf contaminated hundreds of thousands of Android set-top bins just about in a single day, utilizing a widespread vulnerability in these residential proxy providers to compromise different Android-based gadgets contained in the native networks of unsuspecting TV field customers.
Synthient’s analysis brought about dozens of residential proxy suppliers to patch their networks, which helped to fragment the Kimwolf botnet into a lot smaller items that made its incessant and disruptive DDoS assaults far simpler for community operators to handle. It additionally attracted the eye of the Movement Image Affiliation (MPA), a commerce group representing the foremost Hollywood studios, which partnered with Synthient to buy and tear aside numerous in style Android TV set-top bins — together with some that have been being contaminated by Kimwolf and different IoT botnets.
In a report revealed at present, Synthient examined a preferred, pre-infected TV field offered underneath the model MECOOL by a publicly traded firm in China known as Skyworth Know-how, concluding that MECOOL additionally bundled the malware from Videostrong Know-how Co. and likewise put in AppSalt/Honeygain and different proxy elements.
The MECOOL storefront and advertising. Picture: Synthient.com.
Synthient founder Ben Brundage informed KrebsOnSecurity that Videostrong’s malware additionally distributed software program for the proxy service Grass. In our November 2025 story, “Is Your Android TV Streaming Field A part of a Botnet?” we quoted a researcher from Censys who discovered the favored Superbox TV streaming gadget bundled Grass’s residential proxy software program. We additionally quoted the Grass founder, who denied any affiliation with the TV field maker.
That November 2025 story famous that Superbox and comparable Android TV set-top bins achieve new prospects primarily by partaking influencers on Tiktok and different social networks who reward the product’s capacity to supply a whole bunch of (pirated) pay TV streaming providers for a one-time charge.
Likewise, Synthient’s report observes that the MECOOL set-top bins exploded in reputation after the product was talked about in 2023 by the Youtube channel Linus Tech Ideas, which has an viewers of practically 17 million subscribers [Linus Tech Tips said in a statement shared with Synthient that it has since updated the video to explicitly frame the product as a scam and have removed all associated affiliate links].
The favored Youtube channel Linus Tech Ideas discussing MECOOL TV streaming bins.
The GTIG report estimates the XCPE botnet takedown ought to sever entry to no less than 10 million further compromised gadgets, noting that the assorted proxy and advert fraud associates of Videostrong “every have diversified distribution channels for his or her modules past XCPE.”
Synthient’s Brundage echoed that conclusion, calling the 1.3 million quantity “extremely conservative.”
“The dimensions of affected gadgets is probably going approach increased,” he stated. “That is most likely the most important operation in opposition to backdoored TV bins that we’ve seen.”
Additional studying:
Plume Safety Labs white paper on the XCPE botnet (PDF)
Black Lotus Labs writeup on LinkedIn
TrendAI’s evaluation
Synthient’s listing of affected gadgets, damaged down by mannequin quantity
