Summary
- Google and industry partners dismantled the XCPE botnet, which compromised more than 1.3 million Android TV set-top boxes shipped with pre-installed malware by manufacturer Videostrong Technology Co.
- Infected devices were enrolled as residential proxies—renting out users’ IP addresses without consent—and used for advertising fraud, with criminal affiliates paying Videostrong for access.
- The malware extended beyond TV boxes to Android-based healthcare devices, karaoke machines, and digital signage systems; researchers estimate the true device count is significantly higher than 1.3 million.
- Multiple residential proxy services, including AppSalt/Honeygain (owned by Oxylabs) and NetNut, had their SDKs routinely downloaded by XCPE-infected devices.
- Google has since addressed the firmware-loading weakness Videostrong exploited and has severed its relationship with the manufacturer; the takedown is expected to cut off access to at least 10 million additional compromised devices.
What Happened
Google’s Threat Intelligence Group, working alongside a number of industry partners, has taken down the infrastructure behind a botnet called XCPE—named after a core component of the malware involved. The botnet was built on more than 1.3 million Android TV set-top boxes that shipped with malicious software already embedded. Videostrong Technology Co., a Chinese TV box manufacturer, was identified as the party responsible for including that malware. Google has terminated its relationship with the company and took legal action to seize the domains and servers Videostrong used to control the botnet and push additional malware onto infected devices.
How the Scheme Worked
Videostrong’s malware loaded automatically when a user first booted one of the affected devices. From that point, the device’s internet connection was made available for resale through residential proxy services—networks that allow paying customers to route their traffic through other people’s IP addresses, effectively masking their true identity or location. Videostrong monetised this access by selling it to criminal affiliates, who in turn used the infected devices to conduct advertising fraud and other malicious activity. Users had no knowledge their devices were being used in this way.
Broader Device Exposure
While TV set-top boxes formed the bulk of the botnet, the XCPE malware was also found in other Android-based IoT products, including telehealth devices, karaoke machines, and digital signage systems. The GTIG report estimates the takedown should sever access to at least 10 million additional compromised devices beyond the 1.3 million core figure, because the various proxy and advertising fraud affiliates of Videostrong had diversified their own distribution channels beyond XCPE. Synthient founder Ben Brundage, whose firm contributed to the takedown, described the 1.3 million figure as highly conservative, adding that the true scale is likely substantially higher.
Residential Proxy Services Named
The GTIG report specifically calls out several residential proxy providers whose software development kits were routinely installed on XCPE-infected devices. These include AppSalt, also known as Honeygain, which is owned by the Lithuanian company Oxylabs—recently rebranded as Source following a $130 million private equity investment that valued the business at $3.6 billion. Also named is NetNut, operated by the publicly traded Israeli company Alarum Technologies, which was the subject of a separate FBI-led domain seizure action related to a different botnet called Popa. Additional providers named include EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb, and GaGaNode. Oxylabs did not respond to a request for comment.
The MECOOL Connection and Supply Chain Risk
Startup threat research firm Synthient, working with the Motion Picture Association, purchased and forensically examined a range of popular Android TV boxes as part of a broader investigation. Their analysis of the MECOOL brand—sold by publicly traded Chinese company Skyworth Technology—found it also bundled Videostrong’s malware and installed the same proxy components. MECOOL gained significant consumer traction after being promoted by the YouTube channel Linus Tech Tips, which has close to 17 million subscribers. That channel has since updated its content to characterise the product as a scam and removed all associated affiliate links. Synthient’s research also found that Videostrong’s malware distributed software for the residential proxy service Grass.
How Videostrong Bypassed Google’s Controls
Google requires Android device manufacturers to pass compatibility and security testing before their products reach consumers. Videostrong circumvented these requirements by loading the malicious software at the moment of first boot—after the device had cleared Google’s testing process. Google states it has since addressed this weakness. The episode illustrates a recurring challenge in the Android ecosystem: pre-market certification provides limited protection if a manufacturer can introduce malicious code through the device initialisation sequence.
Why it matters
For CISOs, the XCPE botnet case is a concrete demonstration that consumer-grade IoT devices—including those entering healthcare and enterprise environments—can arrive pre-compromised from the manufacturer, with no visible indicator of infection. Devices used by employees at home, or IoT equipment procured through informal channels, represent a supply chain risk that sits entirely outside standard endpoint visibility tools. The involvement of telehealth devices is particularly significant: those environments carry regulatory obligations around data integrity and network integrity that a silent proxy agent would directly undermine. The residential proxy angle also has downstream implications—traffic originating from your own network’s IP space, or from IP ranges your organisation relies on, may be tainted by botnet-driven fraud activity that affects your reputation with ad platforms, fraud detection services, and upstream network providers.
What to do now
- Audit any Android-based IoT devices on your network—including set-top boxes, digital signage systems, and telehealth equipment—against Synthient’s published list of affected models, broken down by model number.
- Review procurement policies to ensure Android-based IoT devices are sourced from verified supply chains, and require evidence of security testing for any device seeking network access.
- Monitor outbound traffic from IoT device segments for connections to known residential proxy service infrastructure, including the providers named in the GTIG report: AppSalt/Honeygain, NetNut, EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb, and GaGaNode.
- Where possible, isolate consumer-grade Android TV and IoT devices to network segments with restricted outbound internet access, limiting their ability to function as proxies even if compromised.
- Brief procurement and IT asset management teams on the risk of devices promoted through social media influencer channels, which this case shows can rapidly introduce pre-infected hardware into homes and workplaces.
