Back Crime-Research

Google and Partners Dismantle XCPE Botnet of 1.3 Million Android TV Boxes

Crime-Research • November 10, 2026

Google said it worked with industry partners to dismantle “XCPE,” a botnet of more than 1.3 million Android TV set-top boxes that were pre-loaded with malware. The infected devices rented out their owners’ internet connections to residential proxy services and were used for advertising fraud. According to KrebsOnSecurity, experts involved estimate the takedown should also cut off access to at least 10 million further compromised systems, including other Android-based IoT gear such as digital signage and karaoke machines, though that figure is an estimate.

Google Threat Intelligence Group concluded that Chinese manufacturer Videostrong Technology built the malware into its products and monetized the backdoor by selling access to criminal affiliates, who could load their own modules onto the devices. Google says the malware was installed right after a device’s first boot, bypassing its compatibility and security testing for Android device makers, a weakness it says it has since fixed. The company severed ties with Videostrong and took legal action to take down the domains and servers used to control the botnet. The report names several proxy services that used the infected devices, including products from Oxylabs/Honeygain and NetNut; Oxylabs said it has no record of Videostrong, suspended a supplier linked to a malware loader and sent a formal legal inquiry.

Research by proxy-tracking firm Synthient, which examined MECOOL-branded boxes, contributed to the findings, and it considers the 1.3 million figure conservative. Residential proxy networks are widely associated with account takeover, ad fraud and scraping. The takedown was also covered by Dark Reading and Infosecurity Magazine.

Read the original report →

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Google Dismantles XCPE Botnet of 1.3 Million Android TV Boxes Google has dismantled a botnet of over 1.3 million Android TV boxes, which were compromised by a backdoor embedded by the manufacturer, Videostrong Technology. The malware, known as XCPE, allowed criminals to hijack devices for advertising fraud and other malicious activities. The backdoor bypassed Google’s certification checks, as it was installed after the initial setup. Google has severed ties with Videostrong and taken legal action to dismantle the botnet's control servers. Trend Micro estimates that approximately 1.47 million devices were infected globally, with significant numbers in countries like Malaysia and Brazil. The malware remains difficult to remove as it can reinstall itself from protected system partitions. Google has closed the loophole that allowed the infection and banned Videostrong from producing certified devices. The incident raises concerns about the potential for AI-driven malware to autonomously replicate across devices. 3 sources 58

Extracted Entities

Google and Partners Dismantle XCPE Botnet of 1.3 Million Android TV Boxes

The full story

Extracted Entities

Attack Types (2)

Companies (2)

Malware (1)

Platforms (2)

Tools (2)