Google Dismantles Botnet Built Into 1.3M TV Set-Top Boxes

Google and industry partners have successfully taken down a major botnet infrastructure called XCPE that compromised over 1.3 million Android TV set-top boxes. The malware was intentionally pre-installed by Chinese manufacturer Videostrong Technology Co., which also embedded the malicious code in other IoT devices including healthcare equipment and karaoke machines. The operation revealed that Videostrong deliberately infected its products to enable criminal monetization schemes.

The XCPE malware secretly converted infected devices into “residential proxies”—selling users’ internet addresses to multiple criminal services without their knowledge or consent. This infrastructure facilitated advertising fraud, account takeover attacks, and data scraping operations. Videostrong profited by licensing the backdoor access to various criminal affiliates who loaded additional malware onto the compromised devices. Google’s action involved taking down the command-and-control domains and servers used to maintain the botnet.

Security researchers estimate the takedown will sever access to at least 10 million additional compromised devices beyond the initial 1.3 million TV boxes, making this likely the largest enforcement action against manufacturer-backdoored devices to date. The investigation involved security startup Synthient, which has been tracking proxy-based botnets and their distribution through social media influencers. Multiple residential proxy providers—including Honeygain, NetNut, and others—were identified as receiving infected device traffic from the XCPE botnet.