Google-Led Takedown Dismantles Botnet Built From 1.3 Million Malicious Android TV Boxes

Google said Thursday it worked with industry partners to dismantle a botnet composed of more than 1.3 million Android TV set-top boxes that shipped from the factory with malicious software. The malware secretly rented users' Internet connections to strangers through residential proxy services and conducted advertising fraud, all without the device owners' knowledge or consent. A report from the Google Threat Intelligence Group (GTIG) concluded that Videostrong Technology Co., a TV box manufacturer based in China, was responsible for embedding the malware, which researchers dubbed XCPE after one of its core code components. Google said it took legal action to seize the domains and servers Videostrong used to control the botnet and install additional malicious software. The company said it has also severed its business ties with Videostrong. "Videostrong monetized the backdoor by selling access to criminal affiliates and loading those affiliates' malware modules onto infected devices," the GTIG report stated. "A device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust, and represents a serious risk to those users." The malware converted infected devices into residential proxies, a category of service that lets customers rent Internet addresses belonging to ordinary home users in order to anonymize their traffic or spoof their location. Residential proxies have become a major source of unwanted traffic online, including account takeover attacks, advertising fraud, and mass content scraping for artificial intelligence projects. The GTIG report named several proxy providers whose software was routinely downloaded by XCPE-infected devices, including AppSalt, also known as Honeygain, which is owned by the Lithuania-based Oxylabs. Oxylabs, which was relaunched in October 2026 under the new brand Source after receiving $130 million in funding from private equity firm Warburg Pincus at a reported valuation of $3.6 billion, did not respond to a request for comment. Other proxy providers identified in the report include NetNut, operated by the publicly traded Israeli company Alarum Technologies, along with EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb and GaGaNode. NetNut came under scrutiny earlier: in July 2026, the FBI and industry partners seized hundreds of domains associated with the company, alleging it operated a separate botnet called Popa that enslaved TV boxes as residential proxies. While TV boxes made up the majority of the botnet, the XCPE malware was also found in other Android-based Internet of Things products, including telehealth devices, karaoke machines and digital signage systems. Google said it requires all Android device makers to pass compatibility and security tests, but that Videostrong found a way to load its malicious software immediately after a user booted an infected device for the first time. Google said it has since addressed that weakness. Google's announcement credited several industry partners, including Synthient, a startup that tracks proxy providers. In January 2026, Synthient published research on the Kimwolf botnet, which was hammering networks worldwide with record-setting denial-of-service attacks after infecting millions of Android set-top boxes virtually overnight. That research prompted dozens of proxy providers to patch their networks, fragmenting Kimwolf into smaller pieces that were easier for network operators to manage, and drew the attention of the Motion Picture Association, which partnered with Synthient to purchase and dissect a number of popular Android TV boxes. In a report published alongside Google's announcement, Synthient examined a pre-infected TV box sold under the MECOOL brand by the publicly traded Chinese company Skyworth Technology, concluding that MECOOL also bundled Videostrong's malware along with AppSalt/Honeygain and other proxy components. Synthient founder Ben Brundage said Videostrong's malware also distributed software for the proxy service Grass. MECOOL boxes surged in popularity after being endorsed in 2023 by the YouTube channel Linus Tech Tips, which has nearly 17 million subscribers. Google estimates the takedown will sever the botnet's access to at least 10 million additional compromised devices, noting that Videostrong's proxy and ad fraud affiliates each maintain distribution channels beyond XCPE. Brundage called the 1.3 million figure highly conservative. "The scale of affected devices is likely way higher," he said. "This is probably the largest operation against backdoored TV boxes that we've seen."