Google announced today that it has successfully worked alongside a coalition of industry partners to dismantle a sprawling botnet consisting of more than 1.3 million Android TV set-top boxes. These devices arrived pre-loaded with malicious software designed to secretly rent out unsuspecting users’ internet connections to external strangers while simultaneously conducting widespread advertising fraud. Security and threat intelligence experts involved in the collaborative takedown note that the decisive enforcement action will likely sever the botnet’s secondary access to more than 10 million additional compromised systems. These secondary targets include a wide array of Internet of Things (IoT) products, ranging from Android-based healthcare and telehealth devices to commercial karaoke machines and digital signage systems.
According to a detailed technical report published by the Google Threat Intelligence Group (GTIG), Google has officially severed all business and operational ties with Videostrong Technology Co., a prominent TV box manufacturer based in China. GTIG and various other cybersecurity industry researchers concluded that Videostrong was directly responsible for embedding the malicious code that enrolled more than 1.3 million set-top boxes into a dangerous botnet dubbed “XCPE,” named directly after one of the malware’s primary core code components.
The Google Threat Intelligence Group report explains that the XCPE botnet automatically loaded infected user devices with background software that made their home internet IP addresses available for commercial resale by multiple “residential proxy” services. These commercial proxy services allow paying customers to rent residential internet addresses to mask their real identities, anonymize web traffic, or artificially spoof their geographic locations. As documented extensively across security research over the past year, residential proxy networks have rapidly evolved into a major source of malicious and unwanted internet traffic. This traffic is frequently leveraged by threat actors to execute account takeover attacks, orchestrate complex advertising fraud campaigns, and harvest mass content scraping for artificial intelligence training projects.
In its public analysis, GTIG noted that Videostrong successfully monetized the hidden backdoor by selling direct access to various criminal affiliates and loading those malicious third-party modules straight onto the consumer devices. Google took decisive legal action to seize the specific domains and command-and-control servers that Videostrong utilized to manage the botnet and distribute secondary malware payloads. GTIG emphasized that a hardware manufacturer intentionally infecting its own consumer base with malware represents an extraordinary and completely unacceptable breach of trust, exposing everyday users to severe cybersecurity risks without their knowledge or explicit consent.
Although standard Android set-top boxes made up the vast majority of the compromised hardware, the GTIG report highlights that identical XCPE malware variants were discovered embedded within alternative Android-based IoT products. These secondary targets included specialized telehealth systems, karaoke entertainment hardware, and digital display billboards. Google maintains strict compliance requirements mandating that all Android device manufacturers pass rigorous compatibility and security evaluations to guarantee their hardware does not jeopardize consumer safety. Nevertheless, investigators found that Videostrong managed to circumvent these safeguards by engineering its malicious software to execute immediately upon a user booting up the hardware for the very first time—a vulnerability Google states it has since successfully patched and resolved.
The GTIG threat report specifically calls out a series of residential proxy providers whose software development kits (SDKs) were routinely downloaded by devices ensnared in the XCPE botnet. Among those identified is AppSalt, widely known as Honeygain, which was originally developed by Oxylabs, a data collection firm based in Vilnius, Lithuania. Reports indicate that Oxylabs and Honeygain underwent a major corporate reorganization, establishing them as independent operational platforms under a newly formed umbrella entity named Source. This corporate restructuring followed a substantial $130 million funding injection from private equity firm Warburg Pincus, which reportedly valued the overarching business at approximately $3.6 billion.
Another prominent proxy provider linked directly to the massive botnet infrastructure was NetNut, a sprawling residential proxy enterprise operated by Alarum Technologies, a publicly traded Israeli firm. Back in July, the Federal Bureau of Investigation collaborated with industry partners to seize hundreds of internet domains associated with NetNut, publicly stating that the company was responsible for operating a separate, parallel botnet known as Popa, which similarly enslaved standard TV streaming boxes to serve as unauthorized residential proxies. Additional proxy services flagged within the GTIG report include EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb, and GaGaNode.
Google’s public announcement of the takedown gave significant credit to a coalition of specialized industry partners, including Synthient, an emerging threat intelligence startup that specializes in tracking commercial proxy providers. Earlier in the year, Synthient published groundbreaking research detailing the explosive global spread of the Kimwolf botnet, which at the time was hammering enterprise and residential networks worldwide with record-breaking distributed denial-of-service (DDoS) attacks. Synthient’s analysts documented how Kimwolf managed to infect millions of Android set-top boxes nearly overnight by exploiting widespread security vulnerabilities within residential proxy services, allowing the malware to jump across local networks and compromise secondary Android devices inside the homes of unsuspecting consumers.
The publication of Synthient’s detailed research forced dozens of residential proxy providers to hurriedly patch their underlying networks. This industry-wide remediation helped fracture the Kimwolf botnet into much smaller, isolated fragments, rendering its persistent and disruptive DDoS attacks far easier for network operators to mitigate. The research also caught the attention of the Motion Picture Association, the primary trade organization representing major Hollywood film studios. The MPA partnered directly with Synthient to purchase and physically tear apart a wide variety of popular Android TV set-top boxes, including several models actively infected by Kimwolf and related IoT botnet strains.
In a comprehensive report published alongside Google’s announcement, Synthient examined a popular, pre-infected TV streaming box sold under the brand name MECOOL by Skyworth Technology, a publicly traded company in China. Synthient concluded that MECOOL hardware similarly bundled the malicious software supplied by Videostrong Technology Co., which subsequently installed AppSalt, Honeygain, and other auxiliary proxy components without user awareness.
Synthient founder Ben Brundage explained in interviews that Videostrong’s persistent malware also distributed software modules for Grass, another prominent proxy service. This mirrors earlier findings from security researchers at Censys, who discovered that the popular Superbox streaming device similarly bundled Grass’s residential proxy software—though representatives for Grass consistently denied any formal or direct affiliation with the TV box hardware manufacturers.
Investigators noted that streaming hardware brands like Superbox and MECOOL historically achieved rapid commercial growth by leveraging social media influencers across platforms like TikTok and YouTube. These influencers frequently praised the streaming devices for offering hundreds of unauthorized pay-TV channels and premium streaming services for a single, low, one-time hardware fee. Synthient’s report specifically pointed out that MECOOL set-top boxes experienced a massive surge in market popularity after being featured by the prominent YouTube channel Linus Tech Tips, which commands an audience of nearly 17 million subscribers. Representatives for Linus Tech Tips later shared a statement with researchers confirming they had updated the original video to explicitly categorize the product as a consumer scam and removed all associated affiliate marketing links.
The Google Threat Intelligence Group estimates that the dismantling of the XCPE botnet will successfully sever operational access to at least 10 million additional compromised devices. Analysts noted that Videostrong’s various proxy and advertising fraud affiliates maintained diversified distribution channels for their malicious software modules that extended far beyond the core XCPE framework. Synthient founder Ben Brundage echoed this assessment, characterizing the initial figure of 1.3 million infected units as highly conservative. The actual scale of affected consumer hardware is likely significantly higher, making this one of the largest coordinated enforcement operations against pre-infected streaming boxes to date.
Addressing the findings following initial publication, representatives for Oxylabs issued a formal statement clarifying the operational safeguards of their proxy network. The company explained that its infrastructure is architected so that an end-user device cannot function as an active proxy exit node unless the system receives a verifiable signal confirming explicit user consent. However, Oxylabs stated that the malicious app developer successfully fabricated these validation signals to bypass security checks.
Oxylabs emphasized that it maintains no direct corporate records regarding Videostrong Technology Co., though internal reviews identified a specific external malware loader domain mentioned within the GTIG threat report among its supplier accounts. The company stated that it immediately suspended the business relationship, issued a formal legal inquiry, and moved to sever all connections with the offending supplier, which accounted for less than one percent of its total IP address pool. Oxylabs added that it had a signed contract in place with the supplier, whose quality assurance teams had previously assured them that all consumers provided valid consent through legitimate user interfaces.
