Security

Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies

Read full article at source ↗

Based on a feed excerpt; full article content has not been acquired. Source evidence retrieved 03/11/2026, 03:48:24 UTC.

Briefings

Google partnered with industry partners to dismantle a botnet comprising over 1.3 million Android TV set-top boxes infected with XCPE malware. This malware enabled the devices to rent user internet connections to criminal affiliates, facilitating advertising fraud and account takeover. The takedown severed ties with Videostrong Technology Co., a Chinese manufacturer, and targeted multiple proxy providers including AppSalt (Oxylabs) and NetNut (Alarum Technologies). Synthient's research identified MECOOL TV boxes as also infected with Videostrong's malware, while the broader scope of the botnet extended to IoT devices like healthcare equipment and karaoke machines.

Key points

• Google worked with industry partners to dismantle a botnet of over 1.3 million Android TV set-top boxes infected with XCPE malware.
• Videostrong Technology Co., a Chinese manufacturer, was identified as the primary source of the malware that enrolled the infected devices.

Context

The incident involved a botnet dubbed XCPE that rented user internet connections to criminal affiliates for advertising fraud. The takedown targeted Videostrong Technology Co., a Chinese manufacturer, and involved multiple proxy providers including AppSalt (Oxylabs) and NetNut (Alarum Technologies). Synthient's research identified MECOOL TV boxes as also infected with Videostrong's malware, while the broader scope of the botnet extended to IoT devices like healthcare equipment and karaoke machines.

Limitations

Evidence covers only the takedown of the XCPE botnet and identified specific proxy providers and manufacturers. Uncertainty exists regarding the full extent of the botnet's reach beyond the confirmed 1.3 million devices, as the report notes the malware was found in other IoT products but does not quantify the total number of additional compromised systems or the specific impact on non-Android IoT devices.

Generated by Bittrees-hosted qwen35-2b sha256:aaf42c8b7c3c on 03/11/2026, 03:48:51 UTC. Based on publisher-provided feed evidence; may not cover the full original article. Check the source for details.

View archived briefing on IPFS
bafybeiehlnepjwnurcn7lvprkisp6fpwepipa4lmrya3ol3okad4thzxhi