---
title: "The Box Beneath the Television: Google Breaks a 1.3-Million-Device Botnet"
description: "Google says manufacturer Videostrong built the backdoor itself and sold access to criminals. The firm is now banned from Android"
author: "Jan Sokol"
published: 2026-11-03T22:01:48.883Z
modified: 2026-11-04T09:29:39Z
url: https://rews.cc/a/the-box-beneath-the-television-google-breaks-a-1-3-million-d-6f28ee
language: en
tags: ["android", "botnet", "malware", "security", "google", "tech"]
publisher: "Rews (https://rews.cc)"
---

# The Box Beneath the Television: Google Breaks a 1.3-Million-Device Botnet

*Google says manufacturer Videostrong built the backdoor itself and sold access to criminals. The firm is now banned from Android*

By Jan Sokol · November 3, 2026 · https://rews.cc/a/the-box-beneath-the-television-google-breaks-a-1-3-million-d-6f28ee

## In brief

- Google and partners dismantled the XCPE botnet of more than 1.3 million Android TV boxes, according to a GTIG report of November 2
- Google says manufacturer Videostrong deliberately built the backdoor and sold access to criminal affiliates
- Infected devices were sold into residential proxy services including AppSalt/Honeygain and NetNut
- Trend Micro counted 1,472,554 infected devices, most of them in Brazil, Malaysia, Iraq, Mexico and Taiwan
- Videostrong is banned from certified Android, but the malware stays on boxes already sold and Play Protect remains disabled

Some objects come into a home with no ceremony at all. A small Android box is bought cheaply, plugged in under the television and forgotten. It promises films and channels. According to Google, more than 1.3 million of these boxes were working for someone other than the people who owned them.

Google said it had worked with industry partners to dismantle a botnet made of those set-top boxes, [as Krebs on Security reported](https://krebsonsecurity.com/2026/11/tech-firms-dismantle-botnet-that-turned-1-3m-tv-boxes-into-proxies/). The malware on them quietly rented out each owner’s internet connection to strangers and ran advertising fraud. The network is called XCPE, after x.cpe, one of the core pieces of its code. In [its own account](https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet/), published on November 2, the Google Threat Intelligence Group said the takedown happened the week before.

## The builder of the house

In most break-in stories somebody forces the lock. This one is different. Google assesses “with high confidence” that the backdoor and the botnet were “intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.”, which Krebs describes as a TV box manufacturer in China. The company that built the house also kept a key to it. Google concluded that the scheme was neither a rogue insider nor a development mistake.

> Videostrong monetized the backdoor by selling access to criminal affiliates and loading those affiliates’ malware modules onto infected devices.

![A pale hand holds an orange key above a dark hand holding coins, with a dark router-like box featuring an open orange door below.](https://rews.cc/img/665ad75386e5b9df683cd25cb331cfad8fa440fd.webp)

Google says the operators did more than resell bandwidth. They captured live screenshots, injected keystrokes, pulled out account details and system logs, and opened reverse shells on the devices. “A device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust,” the company wrote, “and represents a serious risk to those users.”

The certification system was supposed to prevent this. Google requires Android device makers to pass compatibility and security tests. According to Google, Videostrong used obfuscation to slip through a gap in those tests and load its malicious code after a device’s first boot. Google says it has since changed its review process. The company also reports that in late 2024, possibly in response to its earlier enforcement against the BadBox scheme, Videostrong took the malicious modules out of x.cpe and moved them into a separate package, apparently to keep the core component from being detected.

One reflection, offered only as that: an inspection held at the gate means little to someone who can wait until the guard goes home.

## The trade in borrowed addresses

Most of the hijacked connections were sold into residential proxy services. Customers rent ordinary household internet addresses from these services to hide their own traffic or fake their location. Krebs has documented that such services carry much of the internet’s hostile traffic, from account takeovers and ad fraud to mass scraping of content for AI projects.

![Three yellow cars travel along a dark road passing through a cream house with a yellow roof against a bright blue background.](https://rews.cc/img/b73e050b84f3e979879cfc7804356c8bd47fb480.webp)

Google’s report names the proxy firms whose software kits were routinely downloaded onto infected boxes. One is AppSalt, also known as Honeygain, which is owned by Oxylabs of Vilnius, Lithuania. In October 2026 Oxylabs relaunched under the name Source after receiving $130 million from the private equity firm Warburg Pincus, in a deal that reportedly valued it at $3.6 billion. Oxylabs did not respond to Krebs’s request for comment. Another is NetNut, run by the publicly traded Israeli company Alarum Technologies. In July 2026 the FBI and industry partners seized hundreds of NetNut domains, saying the company operated a separate TV-box botnet called Popa. EarnFM, Traffmonetizer, Jaguar, LINKFOG, IPWeb and GaGaNode are also on the list. Ben Brundage, founder of the proxy-tracking startup Synthient, told Krebs that Videostrong’s malware also distributed software for the proxy service Grass.

## Where the boxes sat

Trend Micro counted 1,472,554 infected devices, somewhat more than Google’s estimate, [Ars Technica reported](https://arstechnica.com/google/2026/11/google-dismantles-botnet-secretly-running-on-1-3-million-android-tv-boxes/). The vast majority were in Brazil, Malaysia, Iraq, Mexico and Taiwan, and tens of thousands more were online in the United States, Germany, Britain, Australia and Canada. TV boxes made up most of the botnet, but Google found the same malware on telehealth devices, karaoke machines and digital signage. Brundage called the 1.3 million figure “highly conservative.” “This is probably the largest operation against backdoored TV boxes that we’ve seen,” he said.

![A cream-colored net encloses dark electronic devices, including a microphone and a screen, against a bright blue background.](https://rews.cc/img/ea73ae9084e7a8eba999dd8ff0e6eb4f4469bf9f.webp)

Synthient also published a report on a popular box sold under the MECOOL brand by Skyworth Technology, a publicly traded Chinese company. It concluded that MECOOL bundled Videostrong’s malware together with AppSalt/Honeygain and other proxy components. Google’s code analysis shows the malware checks whether it is running on a MECOOL device and, if so, connects to a dedicated control server. According to Synthient, the boxes took off after a 2023 mention on Linus Tech Tips, a YouTube channel with nearly 17 million subscribers. The channel said it has since updated the video to call the product a scam and removed all affiliate links. Synthient has published a list of 182 affected model names.

## What the takedown leaves behind

Google credits Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI. It took legal action against the domains and servers Videostrong used to command the botnet, and against the control domains of more than a dozen malware families carried through the backdoor. Because those affiliates had other ways of spreading their modules, Google estimates that the action cuts off at least 10 million additional compromised devices. Videostrong, along with any future subsidiaries or affiliates, is [banned from building certified Android devices](https://www.helpnetsecurity.com/2026/11/02/xcpe-botnet-android-backdoor/) or supplying software to certified vendors.

That ban covers only the part of the world where Google holds the keys. Android is open source, and there are countless uncertified boxes on sale. Videostrong could keep selling hardware under other brands without Google’s apps, although it would have to rebuild its malware operation from scratch.

For the owners, the boxes are now safer than they were, but not clean. Play Protect is still switched off on them. The dormant malware modules are still installed as system apps, and ordinary users cannot easily remove them.

Google says the owners never knew and never consented, and the code their boxes shipped with is still on them.

## Sources

- [Google dismantles botnet secretly running on 1.3 million Android TV boxes](https://arstechnica.com/google/2026/11/google-dismantles-botnet-secretly-running-on-1-3-million-android-tv-boxes/) — Ars Technica
- [Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies – Krebs on Security](https://krebsonsecurity.com/2026/11/tech-firms-dismantle-botnet-that-turned-1-3m-tv-boxes-into-proxies/) — krebsonsecurity.com