Google Dismantles XCPE Botnet in 1.3 Million TV Boxes
Google said Nov. 2 it disrupted the XCPE botnet, built into more than 1.3 million Android TV boxes, and banned Chinese manufacturer Videostrong.
Featured photo: network cables in a wiring closet (file photo). Photo: Wikimedia Commons, public domain, cropped.
WASHINGTON — Google said on Nov. 2, 2026, that it dismantled a botnet built into more than 1.3 million Android TV set-top boxes. Industry partners and Japanese police took part, KrebsOnSecurity reported.
The Google Threat Intelligence Group tied the botnet, called XCPE, to Videostrong Technology, a Chinese device manufacturer, and banned the company from making devices with preloaded Google apps, The Record reported. Videostrong did not respond to requests for comment, The Record reported.
What the botnet did
The malware was embedded in device firmware before the boxes reached homes, The Record reported. It rented out users’ internet connections through residential proxy services and loaded other malware, according to Google.
“Videostrong monetized the backdoor by selling access to criminal affiliates and loading those affiliates’ malware modules onto infected devices,” the Google report said, according to KrebsOnSecurity. Google said the same malware appeared in telehealth devices, karaoke machines and digital signage, KrebsOnSecurity reported.
Infected devices were found in more than 200 countries, The Record reported. Robert McArdle, director of cybercrime research at TrendAI, said the firm’s research identified more than 1.3 million affected devices, according to The Record.
The takedown
Google took legal action to take down the domains and servers used to control the botnet, KrebsOnSecurity reported. Partners included TrendAI, Human and Synthient, The Record reported.
Google estimated the action would cut off access to at least 10 million more compromised devices through the takedown of affiliates’ command-and-control domains, KrebsOnSecurity reported. That figure is Google’s projection and has not been independently confirmed.
Synthient founder Ben Brundage called the 1.3 million figure “highly conservative,” KrebsOnSecurity reported. Charley Snyder, head of disruption operations at the Google Threat Intelligence Group, told The Record that severing the domains was “effectively rendering the malware benign.”
Proxy providers named
Google’s report named residential proxy providers whose software kits were downloaded by infected devices, including AppSalt, also known as Honeygain, developed by Oxylabs, KrebsOnSecurity reported. Oxylabs said a supplier had faked consent signals and that it suspended the relationship, according to a statement shared with KrebsOnSecurity.
What it means
Analysis: The case shows supply-chain compromise at the factory rather than through a later hack. Cutting command servers neutralizes the botnet only while operators lack new infrastructure, since the malware reinstalls itself on the devices, The Record reported. The same proxy ecosystem appears in the separate finding of rentable exits on the White House network.
Sources
- KrebsOnSecurity: Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies
- The Record: Google dismantles massive botnet hidden in Android TV boxes
Related coverage
- Researchers Find Rentable Proxy Exits on White House Network
- CISA, NSA and FBI Warn of China-Linked Data Theft Campaign
- Censys Finds Hundreds of Exposed ARTEX AI Attack Consoles
Related on Peter’s World
- Information War Update Nov 4, 2026: Hormuz Mine Claim, Election Fakes Nov 4, 2026
- Information War Update Nov 3, 2026: Binance Denial, FBI Date Error Nov 3, 2026
- Information War Weekly Roundup: Doppelgänger, Storm-1516, Binance Nov 1, 2026
- Report Maps 1,247 Chinese Overseas Sites in 91 Countries Nov 8, 2026
