Google and Partners Disrupt Massive Botnet Using 1.3M Android TV Boxes

Google and its industry partners have dismantled a large-scale botnet comprising more than 1.3 million Android TV set-top boxes. The botnet, known as XCPE, was used to secretly rent out users’ internet connections to facilitate advertising fraud and anonymise malicious web traffic.

The Google Threat Intelligence Group (GTIG) concluded that Videostrong Technology Co., a TV box manufacturer based in China, was responsible for embedding the malware into its devices. The manufacturer allegedly monetised this backdoor by selling access to criminal affiliates and loading additional malware modules onto the infected hardware.

Residential Proxy Exploitation

The XCPE malware converted infected devices into “residential proxies.” These services allow third parties to rent residential internet addresses to spoof locations, hide web traffic, or conduct activities such as account takeovers, mass content scraping for AI projects, and advertising fraud.

While the primary target was Android TV boxes, researchers believe the botnet’s reach extends far beyond home entertainment. Experts involved in the takedown suggest the action may sever access to over 10 million additional compromised Internet of Things (IoT) devices, including telehealth equipment, karaoke machines, and digital signage systems.

Widespread Distribution and Brand Links

The investigation highlighted several residential proxy providers whose software development kits (SDKs) were frequently used by the botnet. These included AppSalt (also known as Honeygain) and NetNut, the latter of which was previously linked to a separate botnet named Popa by the FBI.

Research from the security startup Synthient also identified that certain popular brands, such as MECOOL—manufactured by Skyworth Technology—and Superbox, bundled components of the proxy software. These products often gained popularity through social media influencers offering pirated streaming services.

Google stated it has since addressed a vulnerability that allowed the malware to load immediately following a device’s initial boot-up sequence. While Google requires Android device manufacturers to pass security and compatibility tests, Videostrong found a method to bypass these protections during the first-time setup of the hardware.