Videostrong

Google Dismantles XCPE Botnet Infecting 1.3 Million Android TV Boxes for Residential Proxy Fraud

Google Threat Intelligence Group collaborated with industry partners to dismantle the XCPE botnet, which had enrolled more than 1.3 million Android TV set-top boxes manufactured by Videostrong Technology Co. The malware secretly turned user devices into residential proxies sold to criminal actors for advertising fraud, account takeovers, and content scraping. The operation is expected to disrupt access to at least 10 million additional compromised IoT devices, including healthcare equipment and karaoke machines. Multiple residential proxy providers such as Honeygain, NetNut, and Grass were linked to the campaign through their SDKs. The takedown also highlighted supply-chain risks in Android-based IoT manufacturing and the role of influencer marketing in distributing pre-infected devices.