"A device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust, and represents a serious risk to those users." — Google Threat Intelligence Group
Google Threat Intelligence Group and the XCPE takedown
Google's Threat Intelligence Group (GTIG) said it worked with industry partners to dismantle a botnet that had enrolled more than 1.3 million Android TV set‑top boxes. GTIG named the botnet "XCPE" and reported that the malware made infected devices available to multiple "residential proxy" services, effectively renting users' Internet addresses to third parties. Google said it severed ties with the TV box maker Videostrong Technology Co., concluded the company was responsible for bundling the malicious software, and pursued legal action to take down domains and servers used to control and expand the botnet.
How XCPE operated and what it enabled
The GTIG report describes XCPE as loading infected devices with software that allowed their Internet addresses to be resold by residential proxy services. Those services are used to anonymize web traffic or spoof locations, but GTIG noted the same channels are a major source of unwanted and often malicious traffic — including account takeover, advertising fraud, and mass scraping for AI projects. Google also said its Android compatibility and security tests exist to prevent harmful products, and that Videostrong nevertheless found a way to load the malicious software "immediately after a user boots up one of these devices for the first time"; Google said it has since addressed that weakness.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleVideostrong, MECOOL, and other infected Android devices
GTIG attributed the primary infections to Videostrong Technology Co., but found XCPE modules in other Android‑based Internet of Things products as well, including telehealth devices, karaoke machines, and digital signage systems. Independent research by Synthient examined a popular pre‑infected TV box sold under the MECOOL brand by Skyworth Technology and concluded MECOOL also bundled Videostrong's malware and installed proxy components such as AppSalt/Honeygain. Synthient founder Ben Brundage told KrebsOnSecurity that Videostrong's malware also distributed software for the proxy service Grass.
Residential proxy providers named in the report
GTIG called out a number of residential proxy providers whose software development kits were frequently downloaded by XCPE‑infected devices. Those providers include AppSalt (also known as Honeygain), which GTIG said is owned by Oxylabs; NetNut, the residential proxy company once operated by the publicly traded Alarum Technologies; and EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb and GaGaNode. The report notes specific industry actions: in July 2026 the FBI worked with partners to seize hundreds of domains associated with NetNut, saying the company operated a separate botnet called Popa that similarly enslaved TV boxes as residential proxies. Separately, Oxylabs was relaunched under the Source brand in October 2026 after a $130 million funding round from Warburg Pincus that reportedly valued the business at $3.6 billion; Oxylabs did not respond to a request for comment.
Synthient, Kimwolf research, and media industry response
Synthient — credited by Google among the partners on the takedown — previously published research in January 2026 into the Kimwolf botnet, which had infected millions of Android set‑top boxes and produced massive DDoS traffic. Synthient's work showed how a vulnerability in residential proxy services enabled rapid spread across local networks, and prompted many proxy providers to patch their networks, fragmenting Kimwolf. The Motion Picture Association partnered with Synthient to purchase and dismantle several popular Android TV boxes that were being infected by Kimwolf and other IoT botnets. Synthient also noted MECOOL's surge in popularity after a 2023 endorsement by the YouTube channel Linus Tech Tips.
What this means for technologists, procurement teams, and end users
- Technologists and security teams — Watch for residual access paths: GTIG estimated the takedown should sever access to at least 10 million additional compromised devices because Videostrong affiliates and proxy modules have diversified distribution channels. Synthient called the 1.3 million figure "highly conservative" and warned the scale of affected devices is likely higher.
- Procurement and device buyers — Verify origin and software provenance: the case centers on a manufacturer allegedly preinstalling backdoors and proxy SDKs in consumer devices, underscoring the value of supply‑chain checks and vendor accountability in purchasing decisions.
- End users and purchasers of Android TV boxes — Exercise caution with prepackaged streaming devices: several popular boxes obtain customers through social media influencer endorsements and bundled pirated services, and independent research found some of those boxes came pre‑infected with proxy and malware modules.
GTIG's takedown and the supporting industry research exposed a complex commercial ecosystem in which device firmware, proxy SDKs and third‑party services intersect to create large pools of residential IP addresses for resale. Google and partners have disrupted one major nexus in that ecosystem, but both GTIG and Synthient say the broader footprint — spanning millions more devices and multiple proxy providers — remains a systemic problem. The full technical writeups from Plume Security Labs, Black Lotus Labs, TrendAI and Synthient provide model‑level lists and deeper analysis for operators who need to measure exposure.
