Executive Overview
In a massive coordinated strike against cybercrime infrastructure, Google—in close collaboration with a coalition of cybersecurity firms, threat intelligence teams, and international industry partners—has successfully dismantled a sprawling botnet consisting of more than 1.3 million compromised Android TV set-top boxes.
Dubbed "XCPE" after one of its core code components, this pervasive botnet relied on a breathtaking betrayal of consumer trust: hardware pre-infected at the factory level. Devices shipped directly to unsuspecting consumers came pre-loaded with covert malicious software designed to siphon internet bandwidth, monetize connections via illicit residential proxy networks, and conduct widespread advertising fraud.
According to findings released by the Google Threat Intelligence Group (GTIG) alongside independent research from threat-tracking startup Synthient, the operation’s impact extends far beyond the initial 1.3 million devices. Security experts involved in the takedown estimate that neutralizing the XCPE command-and-control infrastructure has severed the botnet’s access to more than 10 million additional compromised systems globally. These secondary victims include an array of Internet of Things (IoT) products sharing similar firmware lineages—ranging from telehealth devices and digital signage to karaoke machines and smart displays.
The takedown marks a watershed moment in the ongoing battle against supply-chain infiltration, exposing how rogue hardware manufacturers have turned living room entertainment systems into unwitting nodes for global cybercrime rings.
Detailed Chronology: How the XCPE Botnet Was Built and Toppled
The uncovering and dismantling of the XCPE botnet is the culmination of years of investigative work by security researchers tracking the convergence of cheap streaming hardware, gray-market streaming ecosystems, and the booming commercial residential proxy market.
The Root of the Infection: Factory-Level Backdoors
The genesis of the threat traces back to Chinese hardware manufacturers, chief among them Videostrong Technology Co. According to GTIG, Videostrong embedded sophisticated backdoor malware deep within the core system firmware of its Android TV boxes.
Unlike traditional malware that relies on user error, phishing, or software vulnerabilities downloaded post-purchase, the XCPE payload was baked into the device before it ever left the assembly line. Google noted that while strict compatibility and security tests are mandated for all Android device makers, Videostrong engineered a way to execute its malicious code immediately upon a user booting up the device for the very first time.
Once activated, the malware surreptitiously enlisted the device into the XCPE botnet, converting the user’s home broadband connection into a monetizable asset for cybercriminals.
The Proxy Monetization Engine
The primary utility of the XCPE botnet was its ability to turn residential IP addresses into commercial commodities. The malware loaded infected devices with software that sold access to the host’s internet connection to various "residential proxy" networks. These services allow external clients—ranging from legitimate corporations to malicious actors—to route their web traffic through residential IP addresses, effectively masking their true locations and bypassing geographic blocks or anti-fraud filters.
As documented extensively across the cybersecurity sector, residential proxy networks are frequently abused to facilitate:
- Account takeover (ATO) attacks against financial and retail institutions.
- Sophisticated advertising fraud.
- Massive web-scraping operations for artificial intelligence (AI) model training without authorization.
- Distributed Denial of Service (DDoS) staging grounds.
GTIG’s investigative report explicitly notes that Videostrong monetized these backdoors by selling direct access to criminal affiliates, who then layered their own malware modules on top of the existing XCPE infrastructure.
The Takedown and Collaborative Strike
Recognizing the systemic threat posed by the infrastructure, Google took decisive legal action, seizing the primary domains and servers utilized by Videostrong to maintain command-and-control over the botnet.
Concurrently, industry partners swung into action. The operation was aided by threat-hunting startups like Synthient, major entertainment trade groups like the Motion Picture Association (MPA), and a shifting regulatory and legal landscape that has increasingly targeted rogue proxy operators.
By neutralizing the core command nodes, Google effectively severed the umbilical cord connecting the 1.3 million primary devices—and millions of downstream secondary IoT nodes—to the criminal networks orchestrating the fraud.
Supporting Context & Metrics: The Ecosystem of Compromised Hardware
To understand how a botnet of this magnitude could scale so rapidly, security analysts point to a toxic intersection of consumer demand for pirated content, social media marketing, and lax supply-chain oversight.
The Marketing Machine: TikTok, YouTube, and Gray-Market Streaming
Android TV set-top boxes infected by XCPE and related malware strains—such as the MECOOL brand manufactured by publicly traded Chinese firm Skyworth Technology, and the infamous Superbox devices—rarely sell through mainstream consumer electronics retailers. Instead, they find their way into living rooms through aggressive digital marketing campaigns.
According to research highlighted by Synthient and previous industry reporting, these brands heavily rely on social media influencers on platforms like TikTok and YouTube. Promoted as a "one-time fee" alternative to expensive cable packages, these boxes are marketed for their ability to stream hundreds of pirated pay-TV channels and premium sports broadcasts.
The strategy proved wildly successful. For example, MECOOL set-top boxes experienced an explosion in sales after being featured in 2023 by the massive YouTube channel Linus Tech Tips, which commands nearly 17 million subscribers. (Note: Following subsequent security disclosures, Linus Tech Tips updated the video to explicitly frame the product as a security risk and removed all associated affiliate links).
The Residential Proxy Connection
The GTIG report and independent analyses shed light on the commercial entities whose software development kits (SDKs) and proxy networks were routinely funneled onto XCPE-infected hardware. Among those named are:
- AppSalt (Honeygain): Owned by Vilnius, Lithuania-based Oxylabs. Oxylabs notably underwent a high-profile rebranding to Source following a $130 million funding injection from private equity firm Warburg Pincus, which valued the enterprise at an estimated $3.6 billion. Oxylabs did not respond to requests for comment regarding the findings.
- NetNut: Operated by the publicly traded Israeli firm Alarum Technologies. NetNut was previously tied by federal investigators to a separate botnet dubbed Popa, which also enslaved Android TV boxes as residential proxies before the FBI seized hundreds of its associated domains in mid-2026.
- Other Noteworthy Players: The GTIG report also flagged proxy services such as EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb, GaGaNode, and traffic associated with the proxy network Grass.
The Broader Botnet Landscape
The XCPE takedown does not exist in a vacuum. Earlier in 2026, cybersecurity research brought to light other massive botnet operations, such as Kimwolf, which flooded networks worldwide with record-breaking DDoS attacks. Kimwolf leveraged vulnerabilities in residential proxy networks to infect millions of Android set-top boxes virtually overnight, jumping from device to device across local home networks.
This ecosystem prompted unprecedented cooperation between tech giants, independent security startups, and intellectual property protectors like the MPA, who pooled resources to physically purchase, tear apart, and analyze hundreds of suspicious streaming boxes.
Official Statements and Industry Insights
The revelations surrounding the factory-installed malware have drawn sharp rebukes from tech giants and security researchers alike.
In its official threat intelligence publication, Google did not mince words regarding the culpability of hardware manufacturers:
"A device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust, and represents a serious risk to those users. Without users’ knowledge or consent, infected devices were offered as a distribution mechanism for a wide array of criminal actors."
Ben Brundage, founder of threat-tracking startup Synthient, expressed deep concern regarding the sheer scale of the operation during discussions with cybersecurity journalists. Brundage characterized Google’s confirmed figure of 1.3 million infected boxes as "highly conservative."
"The scale of affected devices is likely way higher," Brundage stated. "This is probably the largest operation against backdoored TV boxes that we’ve seen."
Brundage and other analysts emphasize that because the commercial proxy affiliates tied to manufacturers like Videostrong maintain diversified distribution channels beyond just the XCPE code, the ecosystem of risk extends far beyond a single closed botnet.
Future Outlook: Securing the Smart Home Supply Chain
While Google’s legal action and server seizures have dealt a crippling blow to the XCPE infrastructure, the takedown highlights structural vulnerabilities within the global manufacturing and IoT supply chain that will take years to fully remediate.
- Stricter Supply-Chain Audits: Tech conglomerates and operating system developers face mounting pressure to implement more rigorous, continuous auditing of firmware binaries supplied by original device manufacturers (ODMs), particularly those operating out of overseas jurisdictions with lax cyber oversight.
- Scrutiny on Proxy Providers: The regulatory and legal noose is slowly tightening around commercial residential proxy operators. As demonstrated by joint law enforcement actions against networks like NetNut and heightened scrutiny on firms like Oxylabs/Source, authorities are increasingly treating complicit proxy networks as accessories to cybercrime rather than benign tech startups.
- Consumer Awareness: Security advocates continue to warn consumers against purchasing unverified, gray-market streaming boxes promising "free" access to premium pay-TV networks via social media advertisements. These bargains often carry a hidden cost: turning the consumer’s home network into a staging ground for global cyberattacks.
As the digital landscape evolves, the dismantling of the XCPE botnet serves as both a major victory for collaborative threat intelligence and a sobering reminder that the hardware sitting in our living rooms can all too easily become an adversary within.
