Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies
Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies
🚨 Breaking News: Google has announced that it collaborated with industry partners to dismantle a massive botnet comprised of over 1.3 million Android TV set-top boxes infected with malicious software. This malware secretly rented users’ Internet connections to strangers and was involved in advertising fraud.
Experts involved in the operation believe this action will cut off the botnet’s access to more than 10 million additional compromised systems, including various Internet of Things (IoT) devices like healthcare gadgets and karaoke machines.
According to a report from the Google Threat Intelligence Group (GTIG), Google has severed ties with Videostrong Technology Co., a Chinese TV box manufacturer identified as responsible for the malware that enrolled these devices into the botnet, dubbed “XCPE.”
The XCPE botnet exploited users’ devices by making their Internet addresses available for resale through multiple “residential proxy” services. These services allow customers to anonymize their web traffic or spoof their true location, contributing to unwanted and often malicious online activities, including account takeovers and advertising fraud.
The GTIG report highlights that Videostrong monetized the backdoor by selling access to criminal affiliates and loading their malware onto infected devices. Google has taken legal action to dismantle the domains and servers used by Videostrong to control the botnet and install additional malware.
“A device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust,” the report states, emphasizing the serious risks posed to users.
While TV boxes constituted the majority of the botnet, the XCPE malware was also found in other Android-based IoT products, including telehealth devices and digital signage systems. Google mandates that all Android device manufacturers pass compatibility and security tests to protect users, but Videostrong managed to load their malicious software immediately upon the first boot of these devices. Google claims to have addressed this vulnerability.
The report also calls out several residential proxy providers whose software development kits were frequently downloaded by devices infected with the XCPE botnet, including AppSalt, also known as Honeygain, owned by Oxylabs. In October 2026, Oxylabs was relaunched under the new brand Source, after securing $130 million in funding from private equity firm Warburg Pincus, valuing the business at $3.6 billion.
For more details, check out the full article here: Read full article