Google stated right this moment it labored with business companions to dismantle a botnet made up of greater than 1.3 million Android TV set-top packing containers that ship with malicious software program which secretly rents the person’s Web connection out to strangers and conducts promoting fraud. Consultants concerned within the takedown say the motion is prone to sever the botnet’s entry to greater than 10 million extra compromised techniques, together with different Web of Issues (IoT) merchandise reminiscent of Android-based healthcare gadgets and karaoke machines.
A report from the Google Risk Intelligence Group (GTIG) stated Google has severed ties with Videostrong Know-how Co., a TV field producer in China that GTIG and different business consultants concluded was accountable for together with malware that enrolled greater than 1.3 million set-top packing containers in a botnet dubbed “XCPE” (named after one of many malware’s core code parts).
The worldwide distribution of XCPE botnet infections. Picture: Google Risk Intelligence Group.
The report stated the XCPE botnet loaded the person’s machine with software program that makes their Web deal with out there for resale by a number of “residential proxy” companies, which permit prospects to hire Web addresses as a solution to anonymize their internet site visitors or spoof their true location. As detailed in a number of tales right here over the previous yr, residential proxy companies are a serious supply of undesirable and infrequently malicious site visitors, together with account takeover exercise, promoting fraud, and mass content material scraping for AI tasks.
“Videostrong monetized the backdoor by promoting entry to legal associates and loading these associates’ malware modules onto contaminated gadgets,” the GTIG submit reads, noting that Google took authorized motion to take down the domains and servers Videostrong used to regulate the botnet and set up extra malware. “A tool producer deliberately infecting their customers with malware is an unacceptable breach of belief, and represents a severe danger to these customers. With out customers’ data or consent, contaminated gadgets had been provided as a distribution mechanism for a wide selection of legal actors.”
The report notes that whereas TV packing containers made up the the vast majority of the botnet, the identical XCPE malware was present in different Android-based IoT merchandise, together with telehealth gadgets, karaoke machines, and even digital signage techniques.
Google stated it requires all Android machine makers to move compatibility and safety checks to make sure their merchandise don’t hurt customers, however that Videostrong however discovered a solution to load their malicious software program instantly after a person boots up certainly one of these gadgets for the primary time (Google says it has since addressed that weak point).
The GTIG report calls out plenty of residential proxy suppliers whose software program growth kits had been routinely downloaded by gadgets contaminated by the XCPE botnet. These embody AppSalt, often known as Honeygain, which is owned by the Vilnius, Lithuania-based Oxylabs. In October 2026, Oxylabs was relaunched beneath a brand new model referred to as Supply, after receiving $130 million in funding from non-public fairness agency Warburg Pincus that reportedly valued the enterprise at $3.6 billion. Oxylabs didn’t reply to a request for remark.
One other supplier linked to the botnet was NetNut, a as soon as sprawling residential proxy firm operated by the publicly-traded Israeli firm Alarum Applied sciences. In July 2026, the FBI labored with business companions to grab a whole bunch of domains related to NetNut, saying the corporate was accountable for working a separate botnet referred to as Popa that enslaved TV packing containers as residential proxies. Different proxy suppliers named within the GTIG report embody EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb and GaGaNode.
Google’s announcement credit plenty of business companions, together with Synthient, a startup that tracks proxy suppliers. In January 2026, Synthient printed analysis into the speedy unfold of the Kimwolf botnet, which on the time was hammering networks worldwide with record-smashing DDoS assaults. Synthient documented how Kimwolf contaminated thousands and thousands of Android set-top packing containers nearly in a single day, utilizing a widespread vulnerability in these residential proxy companies to compromise different Android-based gadgets contained in the native networks of unsuspecting TV field customers.
Synthient’s analysis induced dozens of residential proxy suppliers to patch their networks, which helped to fragment the Kimwolf botnet into a lot smaller items that made its incessant and disruptive DDoS assaults far simpler for community operators to handle. It additionally attracted the eye of the Movement Image Affiliation (MPA), a commerce group representing the main Hollywood studios, which partnered with Synthient to buy and tear aside plenty of common Android TV set-top packing containers — together with some that had been being contaminated by Kimwolf and different IoT botnets.
In a report printed right this moment, Synthient examined a well-liked, pre-infected TV field bought beneath the model MECOOL by a publicly traded firm in China referred to as Skyworth Know-how, concluding that MECOOL additionally bundled the malware from Videostrong Know-how Co. and likewise put in AppSalt/Honeygain and different proxy parts.
The MECOOL storefront and advertising and marketing. Picture: Synthient.com.
Synthient founder Ben Brundage advised KrebsOnSecurity that Videostrong’s malware additionally distributed software program for the proxy service Grass. In our November 2025 story, “Is Your Android TV Streaming Field A part of a Botnet?” we quoted a researcher from Censys who discovered the favored Superbox TV streaming machine bundled Grass’s residential proxy software program. We additionally quoted the Grass founder, who denied any affiliation with the TV field maker.
That November 2025 story famous that Superbox and related Android TV set-top packing containers acquire new prospects primarily by participating influencers on Tiktok and different social networks who reward the product’s capacity to supply a whole bunch of (pirated) pay TV streaming companies for a one-time payment.
Likewise, Synthient’s report observes that the MECOOL set-top packing containers exploded in reputation after the product was talked about in 2023 by the Youtube channel Linus Tech Ideas, which has an viewers of almost 17 million subscribers [Linus Tech Tips said in a statement shared with Synthient that it has since updated the video to explicitly frame the product as a scam and have removed all associated affiliate links].
The favored Youtube channel Linus Tech Ideas discussing MECOOL TV streaming packing containers.
The GTIG report estimates the XCPE botnet takedown ought to sever entry to at the least 10 million extra compromised gadgets, noting that the assorted proxy and advert fraud associates of Videostrong “every have diversified distribution channels for his or her modules past XCPE.”
Synthient’s Brundage echoed that conclusion, calling the 1.3 million quantity “extremely conservative.”
“The dimensions of affected gadgets is probably going means increased,” he stated. “That is most likely the most important operation in opposition to backdoored TV packing containers that we’ve seen.”
Additional studying:Plume Safety Labs white paper on the XCPE botnet (PDF)Black Lotus Labs writeup on LinkedInTrendAI’s evaluation Synthient’s listing of affected gadgets, damaged down by mannequin quantity
