Google dismantles massive XCPE botnet embedded in millions of Android TV devices

In a significant escalation of the ongoing battle against Internet of Things (IoT) exploitation, Google announced today that it has successfully dismantled a massive botnet known as XCPE. This clandestine network, which comprised more than 1.3 million compromised Android TV set-top boxes, was engineered to turn consumer hardware into tools for advertising fraud and illicit residential proxy services. By severing ties with the primary manufacturer responsible for the pre-installed malware, Google’s Threat Intelligence Group (GTIG) has effectively neutralized a sophisticated supply-chain attack that had been operating in the shadows of the consumer electronics market.

The implications of this takedown are far-reaching. Industry experts involved in the collaborative effort estimate that the operation will likely sever the botnet’s access to more than 10 million additional compromised systems. The XCPE malware, named after a core component of its architecture, was not limited to entertainment hardware; forensic analysis reveals the same malicious code was present in a wide range of IoT products, including telehealth devices, karaoke machines, and industrial-grade digital signage systems.

The Anatomy of the XCPE Botnet

At the center of the investigation is Videostrong Technology Co., a China-based manufacturer of set-top boxes. According to Google’s findings, Videostrong deliberately embedded malicious software into the firmware of their devices. Upon the initial boot-up of a new unit, the device would automatically download and execute the XCPE payload.

The primary function of the XCPE botnet was to monetize the user’s internet connection without their knowledge or consent. By installing software that made the device’s IP address available for resale, the botnet enabled "residential proxy" services. These services are highly sought after by criminal syndicates, as they allow users to route malicious traffic—such as account takeover attempts, large-scale advertising fraud, and aggressive web scraping for AI model training—through legitimate residential connections, making the activity difficult for security systems to detect or block.

Videostrong’s business model reportedly involved selling access to these backdoors to various criminal affiliates. These third-party actors would then use the infected devices as a launchpad for additional malware modules, effectively turning the consumer’s living room device into a node for a global cyber-criminal network.

A Chronology of Discovery and Disruption

The discovery of the XCPE botnet is the culmination of years of escalating tension between cybersecurity researchers and manufacturers of "grey market" streaming devices.

• 2023: The popularity of devices like the MECOOL streaming box surges, bolstered by promotional content from high-profile technology influencers on platforms like YouTube. During this period, the devices were widely marketed as a "one-time fee" solution for accessing premium cable content—a practice often synonymous with piracy.
• November 2025: Security researchers at Censys identify that popular streaming boxes, such as the Superbox, were bundling residential proxy software. This marked a turning point in public awareness regarding the risks of budget Android TV hardware.
• January 2026: The cybersecurity firm Synthient publishes a landmark report on the "Kimwolf" botnet. Their research detailed how this network used vulnerabilities in residential proxy services to compromise devices across local networks. The report triggered a wave of security patches across the proxy industry, fragmenting the botnet and making it more visible to law enforcement.
• July 2026: The FBI, in conjunction with international partners, conducts a high-profile seizure of domains associated with NetNut, a major residential proxy provider linked to the "Popa" botnet, which had been enslaving TV boxes.
• October 2026: Oxylabs, a prominent proxy provider, rebrands as "Source" following a $130 million funding round. The company’s past associations with proxy SDKs remain a subject of scrutiny as researchers continue to map the infrastructure of residential proxy networks.
• November 2026: Google officially announces the takedown of the XCPE botnet, identifying Videostrong Technology Co. as the primary orchestrator and confirming the involvement of multiple proxy providers in the distribution chain.

The Role of Residential Proxy Providers

A critical component of the GTIG report is the identification of the residential proxy providers whose software development kits (SDKs) were utilized by the XCPE botnet. These providers, which often position themselves as legitimate data collection services, have become the backbone of modern automated cyberattacks.

Among those named are AppSalt (Honeygain), owned by the Lithuania-based firm Source (formerly Oxylabs), and NetNut, which has previously faced legal intervention for its role in the Popa botnet. Other providers mentioned in the context of the XCPE ecosystem include EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb, and GaGaNode.

The reliance of these botnets on established proxy networks creates a complex web of liability. While many of these companies claim they are not responsible for how their network is utilized by end-users, researchers argue that their business models—which prioritize the acquisition of as many IP addresses as possible—create a direct incentive for the proliferation of malware like XCPE.

Industry and Official Responses

Google’s stance on the issue is uncompromising. In its official blog post, the company emphasized that a manufacturer intentionally infecting their own products represents an "unacceptable breach of trust" and a "serious risk" to global network security. While Google maintains strict compatibility and security requirements for Android device manufacturers, Videostrong bypassed these safeguards by injecting the malware during the post-boot initialization process.

Synthient founder Ben Brundage, whose firm played a pivotal role in tracking the botnet, suggested that the 1.3 million figure provided by Google is a "highly conservative" estimate. Given the shared codebases among various Chinese manufacturing entities, the true scope of the infection is likely much broader.

The Motion Picture Association (MPA) also played an active role in the investigation. By partnering with security firms to purchase and reverse-engineer these devices, the MPA sought to understand how piracy-focused hardware was contributing to the degradation of the broader digital ecosystem. The impact on creators and studios is significant, as these botnets facilitate the mass theft of proprietary content.

Broader Implications and Future Security

The dismantling of the XCPE botnet serves as a stark reminder of the security vulnerabilities inherent in the "Internet of Things." Unlike traditional computers, which receive frequent security updates and are monitored by robust antivirus software, IoT devices are often "set and forget." Once deployed in a home network, these devices can operate for years without the user ever realizing they have been compromised.

The trend of utilizing social media influencers to promote pre-infected hardware has also complicated the situation. For example, the popular YouTube channel Linus Tech Tips previously featured the MECOOL device. Following the revelation of the botnet, the channel updated its content to label the device a scam and removed all affiliate links—a move that underscores the need for greater due diligence in the technology media sector.

Moving forward, the tech industry faces a dual challenge. First, there is a technical need for more robust, hardware-level security in Android-based devices that cannot be bypassed by manufacturers. Second, there is a legal and regulatory challenge: how to hold foreign manufacturers accountable when they knowingly integrate malicious code into their products.

As the XCPE botnet is dismantled, the focus shifts to the remaining "orphaned" devices. Many of these set-top boxes are still active in households worldwide. While the takedown of control domains will prevent the operators from sending new instructions, the malware remains on the devices. Security professionals advise users who own budget, non-branded, or "unlocked" Android TV boxes to disconnect them from their networks immediately, as these devices remain fundamentally untrustworthy.

The XCPE case is a milestone in cybersecurity, demonstrating that the fight against botnets is no longer just about software bugs; it is about the integrity of the global supply chain. As long as there is a market for cheap, "unlocked" hardware, manufacturers will continue to find creative, if illegal, ways to monetize their user base, leaving the door open for the next iteration of the botnet.