Cybersecurity professionals and privacy-conscious users should take note of a major botnet takedown orchestrated by **Google** in collaboration with industry partners. The operation targeted the **XCPE** botnet, a sprawling network that primarily leveraged malicious software embedded in **Android** TV set-top boxes. ### The Anatomy of XCPE: A Supply Chain Compromise The **Google Threat Intelligence Group** (**GTIG**) revealed that the botnet originated from **Videostrong Technology Co.**, a Chinese TV box manufacturer. **GTIG**'s investigation concluded that Videostrong was responsible for pre-installing malware into over 1.3 million set-top boxes, enrolling them into the **XCPE** botnet. **Google** has since terminated its relationship with the manufacturer.  ### Covert Operations: Residential Proxies and Ad Fraud The **XCPE** botnet's primary function was to transform infected devices into nodes for residential proxy services. This allowed third parties to rent users' internet addresses, anonymizing their web traffic or spoofing their true location. As previously highlighted in numerous reports, residential proxy services are frequently exploited for malicious activities, including account takeovers, advertising fraud, and large-scale data scraping for AI projects. "Videostrong monetized the backdoor by selling access to criminal affiliates and loading those affiliates’ malware modules onto infected devices," the **GTIG** report stated. **Google** has taken decisive legal action, seizing domains and servers used by Videostrong to control the botnet and distribute additional malware. This represents a severe breach of trust, with a device manufacturer intentionally compromising user security for illicit gain. ### Beyond TV Boxes: Widespread IoT Infection While **Android** TV boxes formed the core of the botnet, the **XCPE** malware was also discovered in other **Android**-based IoT products. This includes critical devices such as telehealth systems, karaoke machines, and even digital signage, underscoring the broad threat landscape. **Google** mandates that all **Android** device manufacturers pass rigorous compatibility and security tests. However, Videostrong managed to circumvent these safeguards, installing the malicious software immediately upon a device's initial boot-up. **Google** has since addressed this vulnerability. ### Residential Proxy Providers Implicated The **GTIG** report named several residential proxy providers whose Software Development Kits (SDKs) were frequently downloaded by **XCPE**-infected devices. These include: * **AppSalt**, also known as **Honeygain**, owned by the Lithuanian company **Oxylabs**. **Oxylabs** recently relaunched under the brand **Source** after significant private equity funding. * **NetNut**, a residential proxy company operated by the Israeli firm **Alarum Technologies**. The FBI previously seized hundreds of domains associated with **NetNut** in connection with a separate botnet, **Popa**. * Other providers such as **EarnFM**, **Traffmonetizer**, **Jaguar**, **LINKFOG**, **BMW/IPWeb**, and **GaGaNode**. ### Industry Collaboration and Further Discoveries The takedown was a collaborative effort, with particular credit given to **Synthient**, a startup specializing in tracking proxy providers. **Synthient**'s prior research in January 2026 exposed the rapid proliferation of the **Kimwolf** botnet, which was responsible for record-breaking DDoS attacks. Their work led to numerous residential proxy providers patching their networks, significantly mitigating **Kimwolf**'s impact. This research also attracted the attention of the **Motion Picture Association** (**MPA**), which partnered with **Synthient** to analyze popular **Android** TV set-top boxes, revealing further infections by **Kimwolf** and other IoT botnets. In a recent report, **Synthient** examined the **MECOOL** brand of TV boxes, sold by **Skyworth Technology**. Their findings indicate that **MECOOL** devices also bundled malware from **Videostrong Technology Co.**, installing **AppSalt/Honeygain** and other proxy components.  **Ben Brundage**, founder of **Synthient**, further noted that Videostrong's malware distributed software for the proxy service **Grass**. Previous investigations, including a November 2025 article, highlighted the popular **Superbox** TV streaming device bundling **Grass**'s residential proxy software. Many of these compromised devices gain popularity through social media influencers promoting their ability to stream pirated content. For instance, **MECOOL** set-top boxes saw a surge in popularity after being featured on the YouTube channel Linus Tech Tips in 2023. (Linus Tech Tips has since updated the video to label the product as a scam and removed affiliate links).  ### Broader Impact and Ongoing Vigilance The **GTIG** report estimates that the **XCPE** botnet takedown will disrupt access to at least 10 million additional compromised devices. This is because the various proxy and ad fraud affiliates of Videostrong maintain diversified distribution channels for their malicious modules beyond **XCPE**. This operation underscores the persistent threat posed by supply chain compromises and the critical need for robust security practices when deploying IoT devices.