Google: 1.3 Million Android TV Boxes Enrolled in Dismantled XCPE Botnet

Google and a group of industry and law enforcement partners have dismantled the "XCPE" botnet, a network of more than 1.3 million Android TV set-top boxes that was enrolled into a residential-proxy and ad-fraud operation, in a takedown announced November 2, 2026. According to Google Cloud Blog, Google's Threat Intelligence Group assesses with high confidence that the backdoor and botnet were "intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.," a Chinese Android OEM/ODM whose devices carried the malware preloaded in firmware. Krebs on Security reports the disruption is expected to sever access to more than 10 million additional compromised devices beyond the TV boxes, including Android-based telehealth devices, karaoke machines, and digital signage systems.

What was the specific vulnerability?

The vulnerability was a backdoor preloaded into the firmware partition of Videostrong-made Android TV boxes, running at android.uid.system privilege as "x.cpe" and "com.oemservice." According to Google Cloud Blog, the malware was loaded after the device's first boot, a timing chosen to evade Google's compatibility and security tests, and it reinstalled itself from the /oem/ partition if a user uninstalled it. Google says it has since addressed that weakness and implemented firmware-integrity improvements in its OEM review process. Because the implant ran at system privilege inside the firmware partition, it survived factory resets and ordinary uninstall attempts, and it could not be removed without reflashing the device. Videostrong monetized the backdoor by selling access to criminal affiliates, whose modules turned infected devices into residential proxy exit nodes for services including AppSalt/Honeygain, NetNut, Linkfog, EarnFM, Traffmonetizer, Jaguar, BMW/IPWeb and GaGaNode, and into ad-fraud engines operating as CBOXTV and HiddenView.

How was the incident detected?

The incident was detected by Google's Threat Intelligence Group working with industry partners, and the malware had been present in affected devices "since at least late 2024." Per Krebs on Security, Synthient's January 2026 research into the Kimwolf botnet and device teardowns conducted with the Motion Picture Association, which bought and dismantled infected TV boxes, helped surface the ecosystem. Synthient founder Ben Brundage published a same-day report stating that MECOOL-branded TV boxes made by publicly traded Skyworth Technology also bundled Videostrong's malware along with AppSalt/Honeygain proxy components, and that Videostrong's malware also distributed software for the proxy service Grass. Partners credited in the disruption include Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI. The combination of long-running academic-style research, physical teardowns of purchased hardware and vendor telemetry gave the partners both the malware samples and the live infrastructure needed to map the affiliate network before the legal action.

What is the current impact?

The botnet is disrupted but the infection is not fully patched: command-and-control domains and servers have been seized, while devices already in users' homes remain backdoored. Google took legal action to seize the botnet's C2 domains and servers, along with C2 domains used by more than a dozen affiliate malware families, and banned Videostrong, along with any future subsidiaries and affiliates, from building or supplying certified Android devices. According to Krebs on Security, the takedown is expected to cut off more than 10 million additional compromised devices that were reachable through the affiliate C2 infrastructure. Owners of affected devices had their internet connections resold as residential proxies without consent, and were exposed to ad fraud, data exfiltration and the loading of additional malware. Google's Threat Intelligence Group stated: "A device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust."

What are the next steps?

Google has closed the first-boot gap in its OEM review process and implemented firmware-integrity improvements, and affected-device owners are left to replace or remediate infected hardware. The certification ban prevents Videostrong and its future subsidiaries or affiliates from building or supplying certified Android devices. The C2 seizures sever the affiliate malware families' control channels, but no remote cleanup of the firmware-level backdoor on end-user devices was announced in either source. For owners of Videostrong-made or MECOOL-branded boxes, the practical options described in the reporting are limited: because the implant lives in the /oem/ partition and reinstalls itself, a factory reset does not remove it, and neither Google Cloud Blog nor Krebs on Security announced a vendor firmware update that would. The Motion Picture Association's partnership with Synthient, which buys and tears down infected boxes, remains one of the few active remediation channels for hardware already in circulation. Separately, the proxy ecosystem the botnet fed continues to operate commercially: per Krebs on Security, Oxylabs, the owner of AppSalt/Honeygain, raised $130 million from Warburg Pincus in October 2026 at a valuation of roughly $3.6 billion, and the FBI seized hundreds of NetNut domains in July 2026 in a separate action against the Popa botnet.

By the numbers

Source snapshot