Overview
On November 2, 2026, Google announced it worked with industry partners to dismantle XCPE, a botnet of more than 1.3 million Android TV set-top boxes that ship with malicious software. The malware secretly rents out the user's internet connection to strangers through residential proxy services and conducts advertising fraud. Experts say the takedown could cut the botnet's access to more than 10 million additional compromised systems.
How the Devices Were Infected
The malware came pre-installed. Chinese TV box maker Videostrong Technology Co. included it on devices, and it ran immediately after a user first booted the box. Google says it has since fixed that weakness. The same malware was also found on Android-based telehealth devices, karaoke machines, and digital signage.
Videostrong sold access to criminal affiliates and loaded their malware modules onto infected devices. The malware exposed victims' IP addresses for resale and installed proxy software such as AppSalt/Honeygain and Grass.
Synthient's research found that MECOOL boxes, sold by Skyworth Technology, also bundled the malware.
Who Was Involved
- Google Threat Intelligence Group (GTIG) led the effort and took legal action to take down the domains and servers Videostrong used for command and control and for delivering further malware.
- Synthient, a proxy-tracking startup, did the research, working with the Motion Picture Association to buy and analyze set-top boxes.
- Plume Security Labs, Black Lotus Labs, and TrendAI published related analyses.
The GTIG report names proxy providers connected to the ecosystem, including AppSalt/Honeygain, NetNut, EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb, and GaGaNode.
This follows other actions against the proxy economy: in July 2026 the FBI and partners seized hundreds of domains tied to NetNut, which the FBI said ran a separate botnet called Popa.
Why It Matters
Residential proxy networks built on infected consumer devices give criminals clean-looking IP addresses for fraud, credential stuffing, and scraping, and can expose home and small-office networks to abuse traced back to the victim's address.
What to Do
- Check devices. Synthient publishes a list of affected devices broken down by model number on GitHub.
- Avoid no-name Android TV boxes, especially unbranded devices that are not Play Protect certified.
- Isolate IoT and media devices on a separate VLAN or guest network.
- Watch for unexpected outbound traffic from streaming boxes, such as persistent connections to unfamiliar hosts.
- Replace, do not clean. Pre-installed firmware malware generally cannot be reliably removed by users; retire affected hardware.