Google and Partners Dismantle XCPE Botnet Linked to 1.3 Million Android TV Boxes
Summary
Google says it worked with industry partners to disrupt the XCPE botnet, which GTIG linked to malware on more than 1.3 million Android TV boxes. GTIG estimates the action may sever access to over 10 million additional compromised devices.
Key points
- Google says it took legal action against domains and servers used to control the botnet and install additional malware.
- GTIG attributes the malware’s inclusion on TV boxes to manufacturer Videostrong Technology and says access was sold to criminal affiliates.
- The malware made infected devices available to residential proxy services and was associated with advertising fraud.
- GTIG found XCPE malware in other Android-based IoT products, including telehealth devices, karaoke machines, and digital signage systems.
- GTIG estimates the takedown may sever access to more than 10 million additional compromised devices.
- Synthient separately reported finding Videostrong malware and proxy components on MECOOL TV boxes.
Article Details
- Event Type
- Google and industry partners dismantled the XCPE botnet and took legal action to disrupt the domains and servers used to control it.
- Impact
- The botnet had enrolled more than 1.3 million Android TV set-top boxes, which were used to resell users’ internet connections and conduct advertising fraud. Google Threat Intelligence Group estimated the takedown would sever access to at least 10 million additional compromised devices. The article also reports that XCPE malware was found on other Android-based IoT products, including telehealth devices, karaoke machines, and digital signage systems.
People
Threat Actors
Malware
KimwolfIn January 2026, Synthient published research into the rapid spread of the Kimwolf botnet, which at the time was hammering networks worldwide with record-smashing DDoS attacks.Popadomains associated with NetNut, saying the company was responsible for operating a separate botnet called Popa that enslaved TV boxes as residential proxies.XCPEresponsible for including malware that enrolled more than 1.3 million set-top boxes in a botnet dubbed “XCPE” (named after one of the malware’s core code components).
Vendors
Alarum TechnologiesAnother provider linked to the botnet was NetNut, a once sprawling residential proxy company operated by the publicly-traded Israeli company Alarum Technologies.GoogleGoogle said today it worked with industry partners to dismantle a botnet made up of more than 1.3 million Android TV set-top boxes that ship with malicious software which secretly rents the user’s Internet connectionOxylabsThose include AppSalt, also known as Honeygain, which is owned by the Vilnius, Lithuania-based Oxylabs.Skyworth Technologypre-infected TV box sold under the brand MECOOL by a publicly traded company in China called Skyworth Technology, concluding that MECOOL also bundled the malware from Videostrong Technology Co.Videostrong Technology Co.A report from the Google Threat Intelligence Group (GTIG) said Google has severed ties with Videostrong Technology Co., a TV box manufacturer in China that GTIG and other industry experts concluded was responsible for
Products
Android TVsaid today it worked with industry partners to dismantle a botnet made up of more than 1.3 million Android TV set-top boxes that ship with malicious software which secretly rents the user’s Internet connection outMECOOLIn a report published today, Synthient examined a popular, pre-infected TV box sold under the brand MECOOL by a publicly traded company in China called Skyworth Technology, concluding that MECOOL also bundled theSuperBoxIn our November 2025 story, “Is Your Android TV Streaming Box Part of a Botnet?” we quoted a researcher from Censys who found the popular Superbox TV streaming device bundled Grass’s residential proxy software.