Google and partners dismantle botnet infecting 1.3 million TV boxes

Google said on 2 November 2026 that it and industry partners dismantled a botnet built from more than 1.3 million Android TV set‑top boxes, which carried malware that secretly rents the user’s Internet connection to third parties and conducts advertising fraud. The XCPE botnet, tied to Videostrong Technology Co., enrolled devices to provide “residential proxy” services that allow customers to rent Internet addresses to anonymise traffic or spoof location.

Google’s Threat Intelligence Group (GTIG) estimates that taking the botnet down also cuts off access to more than 10 million additional compromised devices, including other Android‑based IoT products such as telehealth devices, karaoke machines and digital signage systems.

The GTIG post notes that Videostrong monetised the backdoor by selling access to criminal affiliates and loading their malware modules onto infected devices, and that Google took legal action to shut down the associated domains and control servers. The report also states that the XCPE malware was found across other Android IoT products beyond TV boxes.

The GTIG report links several residential proxy providers to the botnet’s ecosystem, including AppSalt (Honeygain) and Oxylabs, which has since rebranded as Source after a $130 million funding round. NetNut, operated by Alarum Technologies, is also named, alongside EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb and GaGaNode.

Synthient’s research is cited for highlighting how proxy modules were downloaded by infected devices and for noting MECOOL boxes from Skyworth were also bundled with Videostrong’s malware and proxy components. The GTIG also quotes Synthient’s Ben Brundage, who says the scale is likely far higher than 1.3 million and describes the takedown as potentially the largest operation against backdoored TV boxes observed to date.