Google and partners dismantle XCPE botnet of 1.3M pre-infected Android TV boxes used as residential proxies
Google and industry partners took down the XCPE botnet, which comprised more than 1.3 million Android TV set-top boxes shipped with malware by Chinese manufacturer Videostrong Technology Co. The malware rented out users' Internet connections through residential proxy services and enabled advertising fraud. The Google Threat Intelligence Group (GTIG) says Videostrong sold access to criminal affiliates and loaded their malware modules onto the devices. Google took legal action against the domains and servers used for command and control. Experts expect the takedown to cut the botnet's access to at least 10 million additional compromised devices, and Synthient's founder calls the 1.3 million figure "highly conservative".
Detalhes técnicos
- Videostrong loaded its malicious software immediately after a user first booted one of the devices, getting around Google's Android compatibility and security tests. Google says it has since addressed that weakness.
- Besides TV boxes, XCPE was found in telehealth devices, karaoke machines and digital signage.
- The GTIG report calls out residential proxy providers whose SDKs were routinely downloaded by infected devices, including AppSalt/Honeygain (owned by Oxylabs, relaunched as Source). Other providers linked to the botnet or named in the report are NetNut, EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb and GaGaNode.
- Synthient's report found that MECOOL boxes sold by Skyworth Technology also bundled Videostrong's malware and AppSalt/Honeygain and other proxy components. Synthient's founder also says the malware distributed Grass proxy software.
- The article recalls related activity. In July 2026 the FBI seized domains associated with NetNut (operated by Alarum Technologies), saying it ran a separate botnet, Popa. In January 2026 Synthient documented how the Kimwolf botnet infected millions of Android set-top boxes.
- Affiliates of Videostrong have distribution channels beyond XCPE, so some infected devices may remain.
Remediação
- The article gives no specific user guidance. Synthient published a list of affected devices by model number, and Plume Security Labs, Black Lotus Labs and TrendAI published analyses.
Linha do tempo
-
Google and partners dismantle XCPE botnet of 1.3M pre-infected Android TV boxes used as residential proxies
ler a análise desta fonte ocultar
Google and industry partners took down the XCPE botnet, which comprised more than 1.3 million Android TV set-top boxes shipped with malware by Chinese manufacturer Videostrong Technology Co. The malware rented out users' Internet connections through residential proxy services and enabled advertising fraud. The Google Threat Intelligence Group (GTIG) says Videostrong sold access to criminal affiliates and loaded their malware modules onto the devices. Google took legal action against the domains and servers used for command and control. Experts expect the takedown to cut the botnet's access to at least 10 million additional compromised devices, and Synthient's founder calls the 1.3 million figure "highly conservative".
Technical Details
- Videostrong loaded its malicious software immediately after a user first booted one of the devices, getting around Google's Android compatibility and security tests. Google says it has since addressed that weakness.
- Besides TV boxes, XCPE was found in telehealth devices, karaoke machines and digital signage.
- The GTIG report calls out residential proxy providers whose SDKs were routinely downloaded by infected devices, including AppSalt/Honeygain (owned by Oxylabs, relaunched as Source). Other providers linked to the botnet or named in the report are NetNut, EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb and GaGaNode.
- Synthient's report found that MECOOL boxes sold by Skyworth Technology also bundled Videostrong's malware and AppSalt/Honeygain and other proxy components. Synthient's founder also says the malware distributed Grass proxy software.
- The article recalls related activity. In July 2026 the FBI seized domains associated with NetNut (operated by Alarum Technologies), saying it ran a separate botnet, Popa. In January 2026 Synthient documented how the Kimwolf botnet infected millions of Android set-top boxes.
- Affiliates of Videostrong have distribution channels beyond XCPE, so some infected devices may remain.
Remediation
- The article gives no specific user guidance. Synthient published a list of affected devices by model number, and Plume Security Labs, Black Lotus Labs and TrendAI published analyses.