Android TV botnet in 1.3M boxes is dismantled
The Android TV botnet known as XCPE enrolled more than 1.3 million set-top boxes through malicious software shipped with the devices, according to the Google Threat Intelligence Group (GTIG). On November 2, 2026, Google said it had worked with industry partners and taken legal action against the domains and servers used to control the network. A botnet is a collection of compromised devices operated remotely without their owners' knowledge.
GTIG and other industry specialists concluded that Chinese TV box manufacturer Videostrong Technology Co. was responsible for including the malware, and Google said it had severed ties with the company. XCPE takes its name from a central component of the malicious code. Although TV boxes accounted for most infections, investigators also found the same malware in Android-based telehealth equipment, karaoke machines and digital signage systems. These are Internet of Things (IoT) products, meaning everyday devices that connect to the internet.
The malware installed software that made each household's internet address available through multiple residential proxy services. A residential proxy routes someone else's web activity through an ordinary home internet connection, concealing the customer's actual location and making the traffic appear to come from the affected household. Such services can be used for account takeovers, advertising fraud and large-scale collection of online content for artificial intelligence projects. GTIG said Videostrong made money from the hidden access by selling it to criminal affiliates and delivering those affiliates' additional malware modules to infected devices.
Google requires Android device manufacturers to pass compatibility and security testing intended to prevent harmful products. According to GTIG, Videostrong nevertheless found a way to install its software immediately after a device was started for the first time. Google said it has now addressed that weakness. Owners had not knowingly agreed to have their devices or connections offered as a delivery channel for other operators, GTIG said.
Several residential proxy providers' software development kits, packages of code used to add a service to an application or device, were regularly downloaded by XCPE-infected systems. GTIG named AppSalt, also known as Honeygain, which is owned by Vilnius-based Oxylabs. Oxylabs was relaunched as Source in October 2026 after receiving $130 million from private equity firm Warburg Pincus, in a deal that reportedly valued the business at $3.6 billion. Oxylabs did not respond to a request for comment from KrebsOnSecurity. Other services identified by GTIG included EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb and GaGaNode.
NetNut, operated by publicly traded Israeli company Alarum Technologies, was also linked to XCPE. In July 2026, the FBI and industry partners seized hundreds of domains associated with NetNut, saying it operated a separate botnet called Popa that also turned TV boxes into residential proxies. Videostrong's malware additionally distributed software for the Grass proxy service, according to Synthient, a company that tracks proxy providers. Earlier Censys research found Grass software bundled with the Superbox TV streaming device, although Grass denied any affiliation with the box manufacturer.
Synthient had previously investigated Kimwolf, another botnet that rapidly infected millions of Android set-top boxes and launched what the company described as record-breaking distributed denial-of-service attacks. A distributed denial-of-service attack, or DDoS attack, overwhelms an online service with traffic from many devices at once. Synthient found that Kimwolf exploited a widespread weakness in residential proxy services to reach other Android devices inside the local networks of unsuspecting TV box owners.
That research prompted dozens of proxy providers to patch their networks, fragmenting Kimwolf into smaller groups whose repeated DDoS attacks were easier for network operators to manage. It also drew the attention of the Motion Picture Association, which represents major Hollywood studios. The association worked with Synthient to buy and examine popular Android TV boxes, including products affected by Kimwolf and other IoT botnets.
In research published alongside the XCPE takedown, Synthient examined a popular pre-infected MECOOL box sold by publicly traded Chinese company Skyworth Technology. It concluded that the product bundled Videostrong's malware and installed AppSalt/Honeygain and other proxy components. Synthient said MECOOL's popularity surged after the product appeared in 2023 on the YouTube channel identified in the research as Linux Tech Tips, which has nearly 17 million subscribers. The channel told Synthient that it later updated the video to describe the product explicitly as a scam and removed the related affiliate links.
Superbox and comparable Android TV products had similarly gained customers through influencers on TikTok and other social platforms who promoted access to hundreds of pirated pay television services for a one-time payment. That sales pitch is a warning sign for buyers because the device's hidden behaviour may be difficult to identify from its streaming functions alone.
GTIG estimates that the action against XCPE could cut off access to at least 10 million additional compromised devices. Its reasoning is that Videostrong's proxy and advertising-fraud affiliates each use distribution routes beyond XCPE for their modules. Synthient described the confirmed total of 1.3 million devices as highly conservative and said the true scale was probably much larger, calling the operation the largest action it had seen against backdoored TV boxes. A backdoor is hidden access that lets another party control a device or install software without normal permission.
Businesses deciding whether connected appliances should be allowed onto workplace networks can use AEU-I for security-first IT, infrastructure and consulting. For readers seeking further technical detail, the published material includes a Plume Security Labs white paper, a Black Lotus Labs write-up, TrendAI's analysis and Synthient's affected-device list organised by model number.