Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies - Krebs on Security

Google announced today that it collaborated with industry partners to dismantle a botnet made up of over 1.3 million Android TV set-top boxes. The devices contained malicious software that secretly rented users' internet connections to strangers and conducted advertising fraud without their knowledge or consent.

According to a report from the Google Threat Intelligence Group (GTIG), the company has severed ties with Videostrong Technology Co., a Chinese TV box manufacturer. GTIG and other industry experts concluded that Videostrong was responsible for including malware that enrolled the devices in a botnet dubbed "XCPE" (named after one of the malware's core code components).

Proxy Services and Fraud

The XCPE botnet loaded infected devices with software that made their internet addresses available for resale by multiple "residential proxy" services. These services allow customers to rent internet addresses to anonymize web traffic or spoof their true location. Residential proxy services have become a major source of unwanted and often malicious traffic, including account takeover activity, advertising fraud, and mass content scraping for AI projects.

Wider IoT Impact

While TV boxes made up the majority of the botnet, the same XCPE malware was found in other Android-based IoT products, including telehealth devices, karaoke machines, and digital signage systems. The GTIG report estimates the takedown should sever access to at least 10 million additional compromised devices, noting that various proxy and ad fraud affiliates "each have diversified distribution channels for their modules beyond XCPE."

Google requires all Android device makers to pass compatibility and security tests, but Videostrong found a way to load malicious software immediately after a user first boots up one of these devices. Google says it has since addressed that vulnerability.

Proxy Providers Involved

The GTIG report identified several residential proxy providers whose software development kits were downloaded by XCPE-infected devices. These included AppSalt (also known as Honeygain), owned by Lithuanian-based Oxylabs, which was relaunched as Source after receiving $130 million in funding. NetNut, operated by Israeli company Alarum Technologies, was also linked to the botnet. The FBI previously seized hundreds of domains associated with NetNut in July 2026, accusing it of operating a separate botnet called Popa.

Other providers named in the report include EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb, and GaGaNode. Google's announcement credited industry partners including Synthient, a startup that tracks proxy providers and had previously researched the Kimwolf botnet.

Scale of the Operation

Synthient founder Ben Brundage called the 1.3 million number "highly conservative," stating that the scale of affected devices is likely way higher. This is probably the largest operation against backdoored TV boxes that we've seen. The company's research found that popular MECOOL TV boxes, endorsed by the YouTube channel Linus Tech Tips with nearly 17 million subscribers, also bundled the same malware.

The takedown operation follows similar actions against IoT botnets and highlights the growing security risks in the consumer electronics market, particularly for streaming devices that gain popularity through social media influencers promoting their ability to offer pirated content.