Google and partners cut off a 1.3-million-box botnet built into cheap Android TVs

Google and partners disrupted XCPE, a botnet of TV boxes shipped with malware that rented out owners' home connections as proxies.

On November 2, 2026, Google announced it had worked with industry partners to take down XCPE, a botnet of more than 1.3 million Android TV set-top boxes. The devices shipped with malware already installed. It rented out owners' internet connections as residential proxies and carried out advertising fraud. Google Threat Intelligence Group traced the malware to Videostrong Technology, a Chinese TV box maker, and Google took legal action against the domains and servers used to control the botnet and push further malware.

Videostrong sold access to criminal affiliates, who loaded their own modules onto the infected boxes. The same malware turned up in other Android-based products, including telehealth devices, karaoke machines and digital signage. Google says it loaded right after a device's first boot, a weakness it has since closed. GTIG named several proxy providers whose software the boxes downloaded, among them AppSalt/Honeygain, NetNut, EarnFM, Traffmonetizer and GaGaNode. Synthient, a proxy-tracking startup and one of Google's partners, published a report the same day. It found that the MECOOL box, sold by Skyworth Technology, bundled Videostrong's malware.

Why it matters: people who buy the cheapest hardware are often the ones whose home connections get quietly resold. Cutting these networks off protects those buyers and the basic reliability of their internet access. GTIG estimates the takedown should cut access to at least 10 million additional compromised devices, because affiliates have other distribution channels. That is an estimate, not a confirmed count.

Caveats: Synthient's founder, Ben Brundage, calls 1.3 million highly conservative. He also says the malware distributed Grass proxy software, a link that comes from him alone. Oxylabs, owner of AppSalt/Honeygain, did not respond to a request for comment. The insecure, pre-infected hardware supply itself is unchanged, so watch whether manufacturers or proxy providers face lasting consequences.

Source: Krebs on Security