More than 1.3 million Android TV set-top boxes shipped with malware that secretly rented out users’ internet connections and conducted advertising fraud, Google said in an announcement reported by KrebsOnSecurity on November 3. Google and industry partners dismantled the botnet, dubbed XCPE, in an operation they expect will also cut access to at least 10 million additional compromised devices through its affiliates’ infrastructure.
The affected population extends beyond television streaming hardware. Google Threat Intelligence Group (GTIG) found the same malware in Android-based telehealth devices, karaoke machines and digital signage systems, although TV boxes accounted for most XCPE infections.
GTIG and other industry experts identified Chinese TV box manufacturer Videostrong Technology Co. as responsible for including the malware. Google said it severed ties with the manufacturer and took legal action to take down domains and servers used to control the botnet and install additional malware.
From first boot to a rented internet connection
The intrusion began with the device supplier. Google requires Android manufacturers to pass compatibility and security tests, but said Videostrong found a way to load malicious software immediately after a customer first booted a device. Google said it has since addressed that weakness.
The malware enrolled devices in XCPE, a name drawn from one of its core code components. It then loaded software that made the owner’s internet address available for resale through multiple residential proxy services. Those services let customers route traffic through another person’s connection to conceal their own address or appear to be in a different location.
For affected owners, the connection became infrastructure for strangers’ traffic without their knowledge or consent. KrebsOnSecurity has documented residential proxies being used for account takeovers, advertising fraud and large-scale content scraping for AI projects.
GTIG said Videostrong sold access to criminal affiliates and installed their malware modules on infected devices. That made the manufacturer’s backdoor a distribution channel for multiple operators, rather than a delivery mechanism for a single proxy service.
Proxy software found on infected boxes
GTIG identified several residential proxy providers whose software development kits were routinely downloaded by XCPE-infected devices. They included AppSalt, also known as Honeygain; NetNut; EarnFM; Traffmonetizer; Jaguar; LINKFOG; BMW/IPWeb; and GaGaNode.
AppSalt/Honeygain is owned by Vilnius-based Oxylabs. In October 2026, Oxylabs relaunched under the Source brand after receiving $130 million from private equity firm Warburg Pincus, in a transaction reportedly valuing the business at $3.6 billion. Oxylabs did not respond to KrebsOnSecurity’s request for comment.
NetNut is operated by publicly traded Israeli company Alarum Technologies; in July 2026, the FBI and industry partners seized hundreds of associated domains, alleging that NetNut operated a separate TV box proxy botnet called Popa.
Synthient, a proxy-tracking startup credited in Google’s announcement, also examined a popular pre-infected box sold under the MECOOL brand by publicly traded Chinese company Skyworth Technology. Its November 3 report concluded that MECOOL bundled Videostrong’s malware and installed AppSalt/Honeygain and other proxy components.
Synthient founder Ben Brundage told KrebsOnSecurity that Videostrong’s malware also distributed software for the Grass proxy service. A November 2025 KrebsOnSecurity report had cited a Censys researcher who found Grass proxy software bundled with Superbox streaming devices; Grass’s founder denied an affiliation with that box manufacturer.
Distribution through consumer marketing helped these products reach buyers. KrebsOnSecurity previously reported that Superbox and similar boxes attracted customers through TikTok and other social-media influencers promoting access to hundreds of pirated pay-TV services for a one-time fee. Synthient said MECOOL’s popularity surged after a 2023 endorsement by the YouTube channel Linus Tech Tips, which has nearly 17 million subscribers.
Why the takedown could reach beyond XCPE
The operation follows earlier work exposing how residential proxy infrastructure can enable infections inside customers’ networks. In January 2026, Synthient documented the separate Kimwolf botnet compromising millions of Android set-top boxes virtually overnight through a widespread vulnerability in residential proxy services. The vulnerability enabled attacks on other Android devices within TV box owners’ local networks.
Kimwolf was then launching exceptionally large distributed denial-of-service attacks worldwide. Synthient’s research prompted dozens of proxy providers to patch their networks, fragmenting the botnet and making its attacks easier for network operators to manage. The Motion Picture Association subsequently partnered with Synthient to buy and examine popular Android TV boxes, including devices infected with Kimwolf and other IoT botnets.
For XCPE, the expected reach of the takedown comes from the affiliates as well as the manufacturer’s backdoor. GTIG said Videostrong’s proxy and advertising-fraud affiliates each distributed their modules through channels beyond XCPE, leading it to estimate that the operation should sever access to at least 10 million additional compromised devices. Brundage called the 1.3 million XCPE figure “highly conservative” and described the action as probably the largest operation against backdoored TV boxes that Synthient had seen.
