Google has announced a major operation with industry partners to dismantle the XCPE botnet, a malicious network that infected more than 1.3 million Android TV set-top boxes and secretly converted them into residential proxy devices. The operation is also expected to disrupt access to more than 10 million additional compromised systems, including other Internet of Things (IoT) products.
The infected devices were reportedly shipped with malware that secretly allowed criminals to use their owners’ internet connections and IP addresses. These connections were then made available through residential proxy services, which sell access to real household internet addresses to customers seeking to hide their online identities or disguise their locations.
According to the Google Threat Intelligence Group (GTIG), the operation involved cutting ties with Chinese TV box manufacturer Videostrong Technology Co., which investigators identified as being responsible for distributing the malware behind the XCPE botnet.
The malware enabled infected devices to become part of a network used for residential proxy services and advertising fraud. Users were reportedly unaware that their internet connections were being rented out or used by third parties.
Residential proxy networks have become a growing cybersecurity concern because they can be abused for account takeovers, advertising fraud, automated data collection and large-scale content scraping.
How the XCPE Botnet Operated
Google’s investigation found that Videostrong allegedly monetized the compromised devices by providing access to criminal affiliates and allowing them to install additional malicious software modules.
The company reportedly used malware components associated with the XCPE botnet to turn ordinary consumer electronics into tools for various criminal activities.
Google also took legal action to disrupt the domains and servers used to control the infected devices and distribute additional malware.
The GTIG report described the practice of manufacturers deliberately installing malicious software on consumer devices as a serious breach of trust, particularly because users had neither knowledge of nor consented to the activity.
Although Android TV boxes represented the majority of infected devices, investigators discovered that the same XCPE malware had spread to other Android-based IoT products. These included healthcare and telehealth devices, karaoke machines and digital signage systems.
This discovery raises concerns about the security of connected devices beyond the entertainment industry.
Google Addresses Security Weakness
Google explained that Android device manufacturers are expected to pass compatibility and security testing before their products can be approved.
However, Videostrong reportedly found a way to install malicious software during the initial startup process when users first switched on their devices.
Google said it has since addressed the weakness that made this possible.
The incident highlights how compromised supply chains and weaknesses in device manufacturing can expose consumers to cybersecurity threats even before they become aware that their products are infected.
Residential Proxy Providers Linked to the Botnet
The Google report also identified several residential proxy providers whose software development kits (SDKs) were repeatedly downloaded by devices infected with XCPE malware.
Among the services mentioned were AppSalt, also known as Honeygain, which is owned by Lithuania-based Oxylabs. In October 2026, Oxylabs reportedly rebranded as Source following a $130 million investment from private equity firm Warburg Pincus. The funding reportedly valued the business at approximately $3.6 billion.
Another company identified was NetNut, a residential proxy provider operated by Israeli publicly traded company Alarum Technologies.
NetNut had previously attracted law enforcement attention. In July 2026, the FBI and industry partners reportedly seized hundreds of domains associated with the company over allegations connecting it to another botnet, known as Popa, which also compromised television streaming boxes and converted them into residential proxies.
Other proxy services named in the Google investigation included:
- EarnFM
- Traffmonetizer
- Jaguar
- LINKFOG
- BMW/IPWeb
- GaGaNode
The findings highlight how compromised consumer devices can become part of commercial proxy networks that may subsequently be exploited by cybercriminals.
Synthient’s Research Helped Expose the Threat
Google credited several industry partners for supporting the disruption, including Synthient, a cybersecurity startup that monitors residential proxy networks and malicious internet infrastructure.
Synthient had previously investigated another major Android device botnet called Kimwolf. In January 2026, the company published research documenting how the malware spread rapidly across millions of Android TV boxes.
Kimwolf exploited weaknesses associated with residential proxy services to reach other Android-based devices connected to the same local networks as infected television boxes.
The botnet subsequently became notorious for launching massive distributed denial-of-service (DDoS) attacks that disrupted networks and online services.
Following Synthient’s findings, several residential proxy providers reportedly strengthened their network security, helping to break up the Kimwolf infrastructure and reduce the scale of its disruptive attacks.
The research also attracted the attention of the Motion Picture Association (MPA), which represents major Hollywood studios. The organisation partnered with Synthient to purchase and examine popular Android TV streaming boxes, including devices suspected of carrying Kimwolf and other IoT-related malware.
MECOOL Devices Also Found With Malicious Software
In a separate investigation published alongside Google’s announcement, Synthient examined a popular Android TV box sold under the MECOOL brand by Chinese technology company Skyworth Technology.
The investigation concluded that the devices also contained malware associated with Videostrong Technology. Researchers additionally identified AppSalt/Honeygain and other residential proxy software components.
Synthient founder Ben Brundage told KrebsOnSecurity that Videostrong’s malware had also distributed software associated with another residential proxy service called Grass.
Concerns about Grass had previously emerged in investigations involving the Superbox Android streaming device. Researchers from Censys discovered that the device included Grass’s residential proxy software.
Superbox and similar streaming products have gained popularity through social media promotions, particularly influencer campaigns on platforms such as TikTok. Their marketing often focuses on providing access to hundreds of television streaming channels through a one-time purchase.
However, the inclusion of residential proxy software raises questions about what additional activities these devices may perform without consumers fully understanding the risks.
Popular Technology Products Under Cybersecurity Scrutiny
Synthient’s investigation also examined how MECOOL streaming boxes gained widespread attention after being featured in a 2023 video by the popular YouTube channel Linus Tech Tips, which has an audience of nearly 17 million subscribers.
Following the investigation, Linus Tech Tips reportedly told Synthient that it had updated the video to identify the product as a scam and removed the associated affiliate links.
The findings demonstrate how seemingly ordinary entertainment devices can introduce security risks into household networks, particularly when manufacturers or software distributors secretly install applications that users did not request.
Takedown Could Affect Millions More Devices
Google estimates that disrupting the XCPE botnet could cut off access to at least 10 million additional compromised devices.
The company explained that the criminal affiliates connected to Videostrong operated several distribution channels beyond XCPE. This means the malware and associated proxy software may have reached a much larger number of devices than those directly identified in the investigation.
Synthient’s Ben Brundage also warned that the reported figure of 1.3 million infected devices could represent only a fraction of the actual scale.
He described the number as highly conservative, suggesting that the total number of affected devices could be considerably higher.
Brundage characterised the operation as potentially the largest crackdown on backdoored television streaming boxes seen so far.
The investigation highlights the growing cybersecurity risks associated with inexpensive Android TV boxes and other connected electronics. It also reinforces the importance of purchasing devices from trusted manufacturers, checking their software security and avoiding products that come with unexplained applications or questionable pre-installed services.
For consumers, the warning is clear: a television streaming box may do much more than provide entertainment. If compromised, it could secretly turn a household internet connection into part of a criminal proxy network, exposing both the device owner and other connected devices to security risks.
Source: Techiex Edited by Bernie
