Google Disrupts XCPE Botnet Linked to 1.3 Million Android TV Boxes
Google says it worked with industry partners to disrupt the XCPE botnet, which enrolled more than 1.3 million Android TV set-top boxes and used their internet connections as residential proxies. The operation also aims to cut off the botnet’s access to at least 10 million additional compromised devices, according to the Google Threat Intelligence Group (GTIG).
GTIG attributed the malware’s inclusion on affected devices to Chinese TV box manufacturer Videostrong Technology Co. Google said it severed ties with the company and pursued legal action to take down domains and servers used to control the botnet and install additional malware. The disruption targets infrastructure used to manage infected devices; the announcement does not establish that every affected device has been cleaned.
Backdoored devices sold as proxy capacity
XCPE is named for a core component of the malware. Once present, the software made an infected device’s internet address available to residential proxy services. Customers of those services can route traffic through consumer connections, obscuring the apparent source or location of their activity. GTIG said Videostrong monetized the backdoor by selling access to criminal affiliates and allowing them to load malware modules onto infected devices.
Set-top boxes accounted for most of the botnet, but researchers also found XCPE malware on other Android-based connected products, including telehealth devices, karaoke machines and digital signage systems. Google said device makers are required to pass Android compatibility and security tests, but Videostrong had found a way to load malicious software when a device was first booted. Google said it has since addressed that weakness.
For organizations, the case highlights a supply-chain risk that extends beyond conventional computers and phones. Consumer and specialist IoT devices can become infrastructure for proxy traffic or other criminal activity, even when their owners have no indication that the devices are compromised. Devices on enterprise, healthcare or retail networks may therefore merit the same attention to inventory, segmentation and outbound traffic monitoring as other network-connected equipment.
Proxy services and related investigations
GTIG identified software development kits associated with several residential proxy providers on devices infected by XCPE. The report named AppSalt, also known as Honeygain, as well as NetNut, EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb and GaGaNode. Google’s announcement credited multiple industry partners, including Synthient, which tracks proxy providers.
In a statement issued after the report, Oxylabs said its system requires a signal indicating that a device has consented before it can act as a proxy exit node. The company said the developer had faked those signals. Oxylabs also said it had no record of Videostrong as a company, but identified a supplier associated with a domain GTIG mentioned as an external malware loader. Oxylabs said it suspended that relationship and would improve checks to detect its software development kit running in unapproved application builds.
The XCPE action comes amid other investigations involving compromised Android TV devices and proxy networks. In July 2026, the FBI and industry partners seized hundreds of domains associated with NetNut, which authorities said operated a separate botnet, Popa. Earlier, Synthient researchers documented the spread of Kimwolf, a botnet that infected Android set-top boxes and used a weakness in residential proxy services to reach other devices on local networks. These are distinct operations, but together they show how proxy infrastructure can be connected to device compromise and broader abuse.
What defenders should take from the disruption
GTIG cautioned that the 1.3 million figure may not capture the full reach of the activity: Videostrong’s proxy and advertising-fraud affiliates had other ways to distribute their software. Synthient likewise described the number as conservative. Google estimated that disrupting XCPE’s control infrastructure should sever access to at least 10 million additional compromised systems, though that estimate concerns access and does not mean those devices were all part of the 1.3 million-device botnet.
Security teams should review inventories for unmanaged Android TV boxes and other connected devices, particularly equipment introduced through informal purchasing or consumer-oriented channels. Where such devices are not required, organizations can remove them; where they are needed, isolating them from sensitive systems and limiting unnecessary outbound connections can reduce exposure. Network monitoring for unexpected proxy-like traffic may help identify devices that warrant investigation. The incident also reinforces the need for procurement and security reviews to cover firmware, first-boot behavior and the software bundled by device manufacturers.
