Google Leads Massive Global Takedown of XCPE Botnet Targeting Millions of Android TV Devices
In a significant victory for digital security, Google announced today that it has successfully coordinated with global industry partners to dismantle the XCPE botnet, a malicious infrastructure that had compromised more than 1.3 million Android TV set-top boxes. The operation, spearheaded by the Google Threat Intelligence Group (GTIG), represents a major strike against the proliferation of pre-infected Internet of Things (IoT) hardware. By severing the command-and-control infrastructure associated with the Chinese manufacturer Videostrong Technology Co., security researchers believe they have not only neutralized the primary botnet but have also effectively blocked access to a wider ecosystem of over 10 million additional compromised devices, including telehealth equipment, digital signage, and karaoke machines.
The XCPE botnet functioned by embedding clandestine software within the firmware of low-cost Android TV boxes. Once these devices were connected to a home network, the malware acted as a gateway for residential proxy services. These services allow third parties—often criminal actors—to rent the unsuspecting user’s residential IP address. By funneling traffic through these hijacked connections, bad actors could anonymize their web activity, bypass geographical restrictions, conduct large-scale advertising fraud, and engage in illicit content scraping for artificial intelligence training sets.
A Chronology of the XCPE Campaign
The discovery of the XCPE botnet is the culmination of a year-long investigation into the supply chain vulnerabilities of Android-based IoT hardware. While the takedown was finalized this week, the roots of the issue date back to late 2025.
In November 2025, researchers first raised alarms regarding the suspicious behavior of popular streaming devices, such as the Superbox, which were found to be bundled with residential proxy software. This sparked a wave of investigations by firms like Synthient and security analysts at Censys. By January 2026, the situation escalated with the emergence of the Kimwolf botnet. Kimwolf utilized the same underlying vulnerabilities found in residential proxy software development kits (SDKs) to launch record-breaking Distributed Denial of Service (DDoS) attacks, creating a crisis for network operators worldwide.
Throughout the first half of 2026, the Motion Picture Association (MPA) joined the effort, working with Synthient to physically acquire and perform forensic teardowns on various Android TV boxes. These investigations revealed that the infection was not an isolated incident but a systemic issue involving multiple manufacturers. By July 2026, the FBI intervened, seizing hundreds of domains associated with NetNut—a proxy provider operated by the Israeli firm Alarum Technologies—after it was linked to the "Popa" botnet. Finally, in November 2026, the coordinated efforts of Google, Synthient, and other industry partners led to the decisive takedown of the infrastructure powering the XCPE botnet, marking a critical turning point in securing the IoT landscape.
The Role of Manufacturers and Supply Chain Vulnerabilities
The GTIG investigation highlights a troubling trend: hardware manufacturers actively participating in the monetization of their own users. Videostrong Technology Co. was identified as the primary architect of the XCPE backdoor. According to Google, the company intentionally embedded malware into the firmware, which activated immediately upon the device’s initial boot sequence.
Google’s investigation revealed that Videostrong monetized these backdoors by selling access to the infected devices to various criminal affiliates. These affiliates would then load additional malicious modules onto the boxes, turning them into versatile tools for cybercrime. This practice represents a severe breach of consumer trust, as the infection occurs before the consumer even has the opportunity to configure the device.
While Google mandates that all Android device manufacturers adhere to strict compatibility and security testing, Videostrong bypassed these requirements through firmware-level manipulation. Although Google has since implemented patches to close the specific vulnerability used by Videostrong, the incident underscores the difficulty of maintaining security across the highly fragmented Android hardware ecosystem, where low-cost, white-label products are often distributed with minimal oversight.
The Broader Ecosystem: Residential Proxy Providers
The XCPE botnet did not operate in a vacuum. It relied on an array of residential proxy services that provided the infrastructure for selling stolen bandwidth. The GTIG report specifically names several providers whose SDKs were frequently found within the XCPE-infected devices. Among these are AppSalt (Honeygain), which is owned by the Lithuanian firm Oxylabs—now rebranded as Source following a massive $3.6 billion valuation and significant capital injection from Warburg Pincus.
The involvement of these providers raises difficult questions regarding the oversight of the residential proxy industry. Many of these firms market their services as legitimate tools for market research or data collection. However, as documented by various security reports throughout 2026, these platforms are frequently abused by bad actors. The list of providers implicated in the broader ecosystem includes NetNut, EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb, and GaGaNode.
Ben Brundage, founder of Synthient, noted that the 1.3 million figure provided by Google is likely a "highly conservative" estimate. Given the shared distribution channels and the ubiquity of these proxy SDKs, the true scale of the botnet—and its successor variations—remains fluid.
Marketing, Influencers, and the Scam Economy
The growth of the XCPE-infected hardware market was fueled in large part by social media marketing. Devices like the MECOOL set-top box, which Synthient confirmed was also bundled with Videostrong-originated malware, gained immense popularity through influencer campaigns on platforms like TikTok and YouTube.
In 2023, the influential tech channel Linus Tech Tips featured the MECOOL device, inadvertently exposing its massive audience to the product. Since the discovery of the malware, Linus Tech Tips has taken steps to mitigate the damage, updating the video to frame the product as a scam and removing all associated affiliate links. This pattern—using influencers to sell devices that offer "free" access to pirated content—has become the primary acquisition strategy for these companies. Consumers, lured by the prospect of saving money on streaming subscriptions, unknowingly purchase hardware that turns their home network into a staging ground for global cyberattacks.
Future Implications and Security Outlook
The takedown of the XCPE botnet is a significant achievement, but experts warn that the underlying issue of insecure IoT manufacturing is far from resolved. The ease with which manufacturers like Videostrong and Skyworth were able to distribute pre-infected devices suggests that current regulatory and security certification frameworks are insufficient to handle the scale of modern global supply chains.
The broader implications for network security are profound. As more devices enter the home—from telehealth monitors to smart home hubs—the potential for these devices to be weaponized continues to grow. The integration of residential proxy SDKs into these devices, often without the user’s explicit knowledge or consent, creates a permanent "always-on" botnet that is difficult for typical users to detect or remove.
Google’s proactive stance in this operation, alongside the work of independent researchers like Synthient and the MPA, signals a shift toward more aggressive enforcement. However, the reliance on voluntary industry cooperation highlights the need for stronger international standards for IoT security. Without standardized, enforceable security requirements for hardware manufacturers, the cycle of botnet creation, discovery, and eventual takedown is likely to continue. For now, consumers are advised to be cautious of low-cost, off-brand streaming devices and to prioritize products from manufacturers with transparent security policies and verified support lifecycles. The dismantling of XCPE serves as a sobering reminder of the hidden costs of "smart" technology when the hardware itself is built upon a foundation of bad faith.
