In a coordinated global cybersecurity operation, technology giant Google has worked alongside industry partners and law enforcement agencies to dismantle the sprawling "XCPE" botnet. The malicious network covertly infected more than 1.3 million Android TV set-top boxes directly at the manufacturing level, transforming consumer entertainment hardware into silent conduits for advertising fraud and unauthorized residential proxy networks. According to findings released by the Google Threat Intelligence Group (GTIG) alongside independent security researchers, the disruption is expected to sever the botnet’s access to an estimated 10 million additional compromised Internet of Things (IoT) systems, including connected healthcare devices, digital signage, and karaoke systems.
The takedown highlights a deeply concerning trend in modern consumer electronics: the pre-infection of hardware by shady overseas manufacturers before it ever reaches store shelves or consumer living rooms. As millions of smart devices populate households worldwide, this incident underscores the severe vulnerabilities embedded within globalized supply chains and the lucrative underground economy surrounding residential proxy monetization.
Anatomy of the XCPE Botnet and Supply Chain Compromise
At the center of the operation is Videostrong Technology Co., a Chinese manufacturer of Android TV set-top boxes. Investigations by GTIG and various security firms concluded that Videostrong intentionally embedded malicious software into the firmware of its hardware. This core malware component—dubbed XCPE—was engineered to execute automatically the moment an unsuspecting consumer booted up their newly purchased device for the first time.
Once activated, the XCPE malware established a persistent backdoor, transforming the Android TV box into a residential proxy node. This backdoor secretly rented out the user’s home internet connection to anonymous third parties. Residential proxy services allow external clients to route their web traffic through residential IP addresses, effectively masking their true geographic locations and digital identities. While legitimate residential proxies exist for market research and web testing, the ecosystem has increasingly become a haven for cybercriminals. Bad actors leverage these networks to execute large-scale account takeovers, perpetrate sophisticated advertising fraud, and engage in mass web scraping to feed data-hungry artificial intelligence projects.
Google’s investigation revealed that Videostrong heavily monetized these backdoors by selling criminal affiliates direct access to the infected boxes, allowing them to load additional malicious modules onto the hardware without the users’ knowledge or consent. In response, Google severed all business ties with Videostrong and pursued legal action to seize the domains and command-and-control servers utilized to manage the botnet.
While Android TV boxes constituted the vast majority of the compromised systems, security analysts discovered identical XCPE malware variants embedded within other Android-based IoT products. These included telehealth devices, karaoke machines, and digital displays. Google maintains rigorous security and compatibility requirements for Android device manufacturers, but Videostrong engineered a sophisticated workaround that bypassed these verification checks during the initial boot sequence—a vulnerability Google has since patched.
The Proliferation of Residential Proxy Services and Industry Enablers
The GTIG report cast a wide net, explicitly calling out several prominent residential proxy providers whose software development kits (SDKs) and monetization libraries were routinely downloaded by devices ensnared in the XCPE botnet. Among those named was AppSalt, widely known as Honeygain, which is owned by the Vilnius, Lithuania-based proxy company Oxylabs. Oxylabs recently underwent a major rebrand, relaunching as Source following a substantial $130 million funding round from private equity firm Warburg Pincus, a transaction that reportedly valued the enterprise at $3.6 billion. Oxylabs did not respond to media requests for comment regarding its alleged ties to the botnet infrastructure.
Another major entity flagged in the investigations was NetNut, a residential proxy network operated by the publicly traded Israeli firm Alarum Technologies. The XCPE takedown follows closely on the heels of a July federal operation in which the FBI and industry partners seized hundreds of domains linked to NetNut, alleging that the firm managed a separate, similarly structured botnet known as Popa that enslaved TV streaming boxes into residential proxy pools. Additional proxy providers cited in the GTIG documentation include EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb, and GaGaNode.
The Timeline of Discovery: From Kimwolf to XCPE
The unravelling of the XCPE botnet is the culmination of months of collaborative detective work across the cybersecurity community, building on a sequence of alarming discoveries throughout 2025 and 2026.
In January 2026, cybersecurity startup Synthient published groundbreaking research detailing the rapid propagation of the Kimwolf botnet, which had been inundating global networks with record-breaking distributed denial-of-service (DDoS) attacks. Synthient’s research revealed that Kimwolf had infected millions of Android set-top boxes virtually overnight by exploiting vulnerabilities in residential proxy service frameworks to pivot into other connected devices operating on local home networks.
The publication of this research sent shockwaves through the industry, prompting dozens of proxy providers to patch their networks. This defensive pressure fragmented the Kimwolf botnet into smaller, more manageable clusters, blunting its disruptive DDoS capabilities. The crisis also drew the attention of the Motion Picture Association (MPA), which represents major Hollywood film studios. The MPA partnered with Synthient to systematically purchase, dismantle, and reverse-engineer popular Android TV streaming hardware to expose the underlying piracy and malware operations.
This collaborative momentum culminated in a November report from Synthient, which examined pre-infected TV boxes sold under the MECOOL brand by Skyworth Technology, a publicly traded company based in China. The investigation concluded that MECOOL devices also bundled Videostrong’s malware, alongside AppSalt/Honeygain and other proxy components.
The Power of Influencer Marketing and Consumer Deception
A critical factor in the explosive growth of these botnets is the marketing apparatus used to distribute compromised hardware to mass-market consumers. Many of these devices—including MECOOL boxes and the infamous Superbox streaming devices highlighted in previous security reports—achieve massive commercial success through targeted campaigns on social media platforms like TikTok and YouTube.
Influencers frequently praise these products for offering hundreds of premium, pay-per-view, and subscription-based television channels for a single, low, upfront fee, effectively marketing hardware designed to facilitate digital piracy. For instance, MECOOL set-top boxes experienced a massive surge in sales following a 2023 feature by the prominent technology YouTube channel Linus Tech Tips, which boasts nearly 17 million subscribers. Following the revelations regarding pre-installed malware, representatives for Linus Tech Tips shared a statement confirming that the channel updated the original video to explicitly frame the product as a scam and removed all associated affiliate links.
Similarly, researchers from Censys previously uncovered that Superbox streaming hardware bundled residential proxy software from the proxy network Grass, though Grass representatives consistently denied any institutional affiliation with the hardware manufacturer.
Implications and the Road Ahead
While Google and its partners have successfully dismantled the primary infrastructure of the XCPE botnet, security experts warn that the underlying threat is far from eradicated. GTIG estimates that the takedown will sever access to at least 10 million additional compromised devices connected to the proxy ecosystem. However, industry analysts emphasize that the figures released so far represent only the tip of the iceberg.
Ben Brundage, founder of Synthient, described the official tally of 1.3 million infected devices as "highly conservative."
"The scale of affected devices is likely way higher," Brundage stated, calling the coordinated action the largest operational disruption against backdoored TV boxes to date. Because Videostrong and its criminal affiliates maintained diversified distribution channels for their malware modules outside of the core XCPE infrastructure, the actors behind the operation are expected to attempt reconstituting their networks under new identifiers.
The XCPE takedown serves as a watershed moment for IoT security, illustrating the urgent need for tighter supply chain oversight, aggressive platform integrity enforcement, and increased consumer awareness. As smart devices continue to infiltrate domestic spaces, regulatory bodies, technology monoliths, and security researchers face an ongoing battle to ensure that consumer hardware functions as an entertainment medium rather than a clandestine weapon for cybercrime syndicates.
