Google and a group of industry partners have taken down a botnet made up of more than 1.3 million Android TV set-top boxes. Google says the company behind it was the boxes’ own manufacturer.
In a Nov. 2 report, the Google Threat Intelligence Group (GTIG) said it has “high confidence” that Videostrong Technology Co., a Chinese OEM and ODM, built, deployed and ran the backdoor to make money. GTIG named the botnet XCPE, after the malware’s core package, x.cpe. Videostrong then sold access to the infected devices to criminal “affiliates,” who loaded their own residential proxy, ad-fraud and backdoor software onto them.
Google has cut ties with Videostrong. It has also banned the company and any future subsidiaries or affiliates from building certified Android devices or supplying software to certified vendors. Separately, Google took legal action to take down the domains and servers that controlled the botnet, along with command-and-control (C2) domains for more than a dozen malware families distributed through it.
The 1.3 million figure is likely the low end. The affiliates also spread their software through channels other than XCPE, so GTIG estimates that taking down their C2 domains will cut off at least 10 million more compromised devices. Synthient founder Ben Brundage told KrebsOnSecurity the 1.3 million count is “highly conservative,” and called the operation probably the largest ever mounted against backdoored TV boxes.
Google worked on the takedown with Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI.
Built into the firmware, not added later
The backdoor came preloaded in the device firmware and ran at Android’s system privilege level. If a user uninstalled it, it reinstalled itself from the device’s /oem partition at the next reboot. GTIG found it in many device models and brands over several years. Google concluded the campaign was not the work of a rogue insider or the result of a development mistake.
Videostrong also got its boxes through Google’s certification. Google requires Android device makers to pass compatibility and security tests. According to GTIG, Videostrong used obfuscation to slip through a gap in those tests and load the malicious code after the device’s first boot. Google says it has since changed its review process and is improving how it verifies firmware integrity on certified Android TV devices.
After setup, the malware kept a persistent connection to a single MQTT broker that took orders from the operators. GTIG documented the following capabilities:
- Silent installation of apps, after turning off Google Play Protect’s app verification
- Arbitrary shell commands with system-level privileges
- Continuous screen capture and injected keystrokes
- Network reconnaissance, including traceroute, ping tests and routing lookups to fingerprint the victim’s network
Most of the C2 traffic GTIG analyzed was routine module installs and configuration. However, GTIG also saw Videostrong operators capture live screenshots, steal account and device information, and open reverse shells on devices.
The malware has kept changing. Starting in August 2026, operators pushed new dropper packages disguised as Android system apps, with names such as com.android.system.ntp. Some variants use a bundled exploit to get root access and copy themselves into the protected /system/priv-app directory.
TV boxes made up most of the botnet, but GTIG also found the malware on other Android-based IoT products: telehealth devices, karaoke machines and digital signage systems.
Your client’s internet connection, rented to strangers
Most of the affiliate modules turned infected boxes into exit nodes for “residential proxy” services. These services sell access to home IP addresses so their customers can hide where their traffic comes from or fake their location. That traffic then appears to come from the client’s home connection. KrebsOnSecurity has reported that residential proxy networks are a major source of malicious traffic, including account takeovers, ad fraud and large-scale scraping for AI projects.
GTIG said Videostrong tried to get as much money as possible out of each box. On a single device, it found as many as three residential proxy SDKs running at once. Proxy providers whose software GTIG found on XCPE devices include:
- AppSalt, the SDK owned by Honeygain, which is in turn owned by Lithuania-based Oxylabs
- NetNut / Popanet, operated by the publicly traded Israeli company Alarum Technologies
- Linkfog, Jaguar, BWM/IPWeb, GaGaNode, EarnFM and Traffmonetizer
Other modules committed ad fraud by loading web pages and ad requests in hidden windows. Still others were additional backdoors, including Moyu and Bird, which GTIG had previously linked to the BadBox operation.
According to GTIG, the AppSalt SDK on these devices registered the user as having opted in without ever displaying a consent screen. It also stopped running if the app had been installed from the Google Play Store. In a statement given to KrebsOnSecurity after publication, Oxylabs said its system requires a consent signal before a device can act as an exit node, and that the developer faked those signals. Oxylabs said it has no record of Videostrong. However, it found com.abc.nexus, the loader GTIG identified, among its suppliers. Oxylabs said it suspended that supplier, sent it a formal legal inquiry, and that the supplier accounted for less than 1% of its IP pool.
NetNut has been in this position before. In July 2026, the FBI and industry partners seized hundreds of NetNut-linked domains over a separate TV-box botnet called Popa. GTIG said the Popanet C2 infrastructure tied to XCPE had already been taken down in that earlier action.
A name brand in the mix: MECOOL
The infected boxes were not limited to no-name products. On the day of Google’s announcement, Synthient published an analysis of a popular MECOOL TV box sold by SKYWORTH Technology, a publicly traded Chinese company. We inquired with SKYWORTH USA, and according to the company, SKYWORTH USA and SKYWORTH Technology are separate entities under parent company SKYWORTH Group Co. Ltd, and SKYWORTH USA has never sold these products.
Synthient found that the MECOOL box shipped with Videostrong’s malware and also installed AppSalt/Honeygain and other proxy components. GTIG’s own analysis supports the link: the malware checks whether a device identifies itself as a MECOOL unit, and if so it connects to a dedicated control server.
According to Synthient, MECOOL boxes became much more popular after a 2023 mention on Linus Tech Tips, a YouTube channel with nearly 17 million subscribers. Linus Tech Tips told Synthient it has since updated the video to describe the product as a scam and removed all related affiliate links. Brundage also told KrebsOnSecurity that Videostrong’s malware distributed software for another proxy service, Grass.
The sales pattern will be familiar to anyone who has followed the gray-market streaming box business. As KrebsOnSecurity reported in 2025, devices like Superbox find buyers mainly through influencers on TikTok and other social platforms. Those influencers promote access to hundreds of pirated pay-TV services for a one-time fee.
What it means for integrators
Look, we know that the vast majority of you are not, and would never, install cheap, no-name products like this in your clients’ homes. However, nothing is stopping that client from doing whatever they want with their technology once you leave.
The main lesson is that a cheap streaming box is not a harmless accessory. An infected box can scan the home network it sits on, run commands and capture the screen. It also routes strangers’ traffic out through the client’s internet connection. GTIG specifically warns that proxy software of this kind could open security holes on a device’s home network. That is the same network carrying a client’s cameras, locks, control system and work-from-home laptop.
Some practical steps:
- Audit what clients plugged in themselves. Look for MECOOL units, “fully loaded” boxes and unbranded Android TV sticks behind secondary TVs. Raise them during service calls and network health checks.
- Specify certified devices. GTIG advises buying set-top boxes only from reputable manufacturers and points to Google’s Android TV partner list. Certification did not stop Videostrong, but Google has closed the gap it used and barred the company.
- Segment streaming and IoT devices. Putting media players, signage players and other IoT gear on their own VLAN or SSID limits what a compromised device can see and reach. This is standard practice, and this takedown shows why it matters.
- Use the published indicators. GTIG’s report lists file hashes, domains and IPs. Examples include the MQTT broker mqtt.szbboys[.]com on non-standard ports 3885–3887, bootstrap hosts under anyevonline[.]com, and broker IPs 219.134.163[.]210 and .211. Integrators who run managed network platforms or DNS filtering can block these and flag any device that tries to reach them.
- Check commercial signage. Because the malware also appeared on digital signage, commercial integrators should review Android-based signage players sourced from little-known ODMs.
- Educate clients about “bandwidth sharing” apps. GTIG tells consumers to be very wary of apps that pay for unused bandwidth. It calls them a primary way illicit proxy networks grow. It also recommends keeping Google Play Protect turned on.
GTIG’s report also calls on the channel to act. It says downstream brands, white-label resellers, telecom providers and online marketplaces share responsibility. It urges retailers and distributors to require independent security audits from ODMs and to quickly delist manufacturers caught abusing the supply chain.
Google said it does not expect this takedown to end the problem. Backdoor operators, ad-fraud rings and proxy providers form a connected supply chain, according to GTIG. When one link is disrupted, the others move to new loaders or rival SDKs.
