---
title: "What Are Botnets? How 1.3 Million Android TV Boxes Became One"
url: https://syntaxradar.com/radar/what-are-botnets-android-tv-boxes
author: "Abdul Rehman, Lead Systems Architect and Technical Director"
publishedAt: 2026-11-04T17:00:00.000Z
dateModified: 2026-11-04T17:00:00.000Z
category: "#SYSTEMS-ARCH"
topic: "what are botnets"
primarySource: https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet
summary: "What are botnets? Google's XCPE takedown shows how 1.3M Android TV boxes became residential proxies, and what owners can check on their own box."
---


# What Are Botnets? How 1.3 Million Android TV Boxes Became One

**Short answer:** Google and partners dismantled XCPE, a botnet that Google says TV box maker Videostrong preloaded on more than 1.3 million set-top boxes to sell residential proxy access and run ad fraud. Google banned Videostrong from certified Android devices.

**Takeaway:** XCPE shows a botnet can ship inside the box: Google says the maker itself preloaded the backdoor, so owners may want to check their model against Synthient's list rather than trust the label.

**Key figures (as reported by the source):**
- Set-top boxes enrolled in XCPE: 1.3 million+
- Extra compromised devices cut off: 10 million+
- Countries reached (TrendAI via CyberScoop): 170+

What are botnets? Picture more than 1.3 million Android TV boxes quietly working for the company that made them. That is the XCPE botnet, which Google's Threat Intelligence Group says it dismantled with partners [last week](https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet).

Google says the maker, Videostrong Technology Co., built the backdoor on purpose and ran it for financial gain. According to Google, the boxes were used to sell residential proxy access (renting out a home internet connection) and to run ad fraud, and Videostrong sold access to criminal affiliates who loaded their own code. If you own an Android streaming box, here is what is known, what is not, and what to check.

Google cut ties with Videostrong, banned it from building certified Android devices, and took legal action to take down the domains and servers that ran the network.

### What are botnets, and what was XCPE?

In cyber security, a botnet is a crowd of internet-connected devices that malware has taken over, all answering to one remote operator. Each device does a small job, and the operator profits from thousands or millions of them at once. The owner may notice nothing unusual.

XCPE is named after a core component of its code. According to [Google's write-up](https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet), it enrolled more than 1.3 million set-top boxes. Google assesses with high confidence that Videostrong, an Android OEM and ODM (a company that designs and builds devices, including ones other brands sell under their own names), developed, deployed and operated it. [Krebs on Security](https://krebsonsecurity.com/2026/11/tech-firms-dismantle-botnet-that-turned-1-3m-tv-boxes-into-proxies/) describes Videostrong as a Chinese TV box maker and reports that Google called a manufacturer intentionally infecting users an unacceptable breach of trust.

Google announced the shutdown on Monday, November 2, [CyberScoop reports](https://cyberscoop.com/google-disrupts-xcpe-botnet-videostrong-android-devices/). The partners Google credits are Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI. Citing TrendAI researchers, CyberScoop says the botnet reached more than 170 countries, with the biggest concentrations in Malaysia, Brazil, Iraq, Mexico and Taiwan, and nearly 44,000 infected devices in the US between June and October.

### How do botnets work inside a TV box?

Botnets work by getting malware onto many devices and controlling them all from one remote server. In an Android TV box botnet like XCPE, the malware was there before the box left the factory. Google says the backdoor is preloaded in the device firmware (the software baked into the hardware) and runs at the android.uid.system level, Android's system-level account. Its package is called x.cpe, or com.oemservice in some builds.

Deleting it does not help. If a user uninstalls the backdoor, it reinstalls itself from the /oem/ partition, a section of storage reserved for the manufacturer, on the next reboot.

Since late 2024, Google says, XCPE has used a three-stage design:

- **The backdoor**, preloaded in firmware, which keeps a foothold on the box.
- **A loader** (com.abc.nexus), which fetches and runs extra code.
- **Monetization modules**, the parts that actually make money, including modules from affiliates who bought access.

To control the boxes, the malware first contacts a server over ordinary HTTP, then holds a persistent connection over MQTT, a lightweight messaging protocol built for always-on devices. Google says it also switches off Google Play Protect, Android's built-in malware scanner, by setting package_verifier_user_consent to -1. That lets it install apps silently. Other capabilities Google lists include running shell commands, capturing the screen, injecting keystrokes and opening reverse shells (a remote command line for the attacker).

How did certified boxes ship like this? According to [9to5Google](https://9to5google.com/2026/11/02/google-android-tv-box-backdoor-shut-down/), Videostrong loaded the malicious code after a device's first boot, which slipped through a gap in Google's compatibility tests for manufacturers. 9to5Google describes the boxes as sold as certified and reports that Google acknowledged a failure on its part. Google says it has since changed its review process and improved firmware-integrity checks on certified Android TV devices, without giving details.

![How botnets work on an Android TV box: diagram of the XCPE chain from a firmware backdoor to a loader to money modules, then Google cutting it off, with 1.3M+ boxes enrolled](/uploads/blog/what-are-botnets-android-tv-boxes/img1.webp)

### What is a residential proxy?

A residential proxy is a service that routes someone else's internet traffic through a home connection, so the traffic appears to come from an ordinary household rather than a data centre. The customer pays the proxy company, and the household behind the connection is the resource being sold.

Residential proxy access was one of XCPE's income streams. Google lists residential proxy and bandwidth software kits (SDKs) it found loaded through the backdoor: Linkfog, AppSalt/Honeygain, NetNut/Popanet, Traffmonetizer, EarnFM, BWM/IPWeb and GaGaNode. They arrived through the preloaded backdoor, not through anything the owner chose to install.

Krebs adds context on two of those names. He reports that AppSalt/Honeygain is owned by Oxylabs, based in Vilnius, which did not respond to his questions. He also reports that NetNut, part of Israel's Alarum Technologies, was linked to a separate botnet called Popa, and that the FBI seized hundreds of NetNut-associated domains in July 2026.

Google's advice reaches beyond TV boxes: it tells people to be wary of any app that pays for "unused bandwidth" or "sharing your internet".

### What are botnets used for?

Botnets are used to earn money from devices that belong to someone else. The XCPE operators had three ways to earn from the same box, according to Google:

1. **Selling your connection.** The residential proxy kits above.
2. **Ad fraud.** Modules called CBOXTV, HiddenView and Fission. Ad fraud means faking views or clicks on ads, so advertisers pay for an audience that is not really there.
3. **Reselling the door itself.** More backdoor modules, named Moyu, Spirit and Bird, and paid access for criminal affiliates who loaded their own code.

The bigger number in Google's post is not 1.3 million. Google says that by disrupting the affiliates' command servers it also cut off access to at least 10 million additional compromised devices from various manufacturers. Google says most infected devices are Android TV boxes, but they also include telehealth devices, karaoke machines and digital signage.

According to CyberScoop, Google said the takedown seriously impacted more than a dozen malicious actors, but warned that the market for backdoors, ad fraud and residential proxies remains resilient. It declined to say when or how it first learned of the activity.

![Photo of a generic Android streaming box plugged into the back of a TV, with a caption bar reading 3 ways one box earned money, next to the Google logo](/uploads/blog/what-are-botnets-android-tv-boxes/img2.webp)

### Is my Android TV box infected?

Whether your Android TV box is infected depends on its model. None of our sources offers a simple self-check, and Google's own post names no brands or models. The brand detail comes from researchers.

Krebs, citing the security firm Synthient, reports that a pre-infected MECOOL box sold by Skyworth Technology bundled Videostrong's malware along with AppSalt/Honeygain and other proxy components. Synthient keeps [a list on GitHub of affected devices by model number](https://github.com/synthient/public-research/tree/main/2026/11/Videostrong) (the link comes from Krebs), and 9to5Google says that list focuses on the Mecool brand. 9to5Google also points to an unconfirmed rumour, from a single Reddit thread, that Mecool is shutting down. We could not verify it.

Two names to keep separate. Krebs has written before about Superbox boxes bundling Grass proxy software (Grass's founder denied any affiliation), but he does not say Superbox is a Videostrong or XCPE product. And if you remember 2024 headlines about a TV-box botnet called Vo1d, reported by Dr.Web, that was a different operation, even though it also involved about 1.3 million Android TV boxes. Do not mix the two sets of numbers.

Synthient founder Ben Brundage told Krebs the 1.3 million figure is "highly conservative" and that this is probably the largest operation against backdoored TV boxes he has seen.

**What we would do as an owner.** These steps are our reading and general security practice, not instructions from Google or the researchers:

- Look up your model number on [Synthient's list](https://github.com/synthient/public-research/tree/main/2026/11/Videostrong).
- Check the Play Protect certification status in the Play Store settings on the box.
- If you are comfortable with developer tools, look for the package names Google lists: x.cpe, com.oemservice, com.abc.nexus, com.android.sso.auth.handler, com.android.system.ntp and com.vs.grass.
- Change the passwords for any accounts you signed into on the box.
- Keep the box off the network your laptops and phones use, for example on a guest network or a separate VLAN.
- If your model is on the list, consider replacing it with a Google TV, Roku, Fire TV or Apple TV device from a reputable maker.

9to5Google's view is that, after the takedown, affected Android TV and Google TV boxes should be safe to use, though owners may want to consider alternatives.

### Are cheap Android TV boxes safe?

Whether cheap Android TV boxes are safe depends on the maker. None of our sources gives a price for the affected boxes, so "cheap" is not something we can test here, and Google's advice points at the maker instead. For buyers it says to:

- buy set-top boxes and other connected devices only from reputable makers (Google keeps a partner list at [android.com/certified](https://www.android.com/certified/));
- be wary of apps that pay for unused bandwidth or sharing your internet;
- install apps only from trusted stores;
- review the permissions of third-party VPN and proxy apps;
- keep Play Protect switched on.

The awkward part is that 9to5Google and CyberScoop describe the XCPE boxes as certified, and the malware switched Play Protect off. Google says it has changed its review process since. In his earlier Superbox reporting, Krebs noted that such boxes were marketed through TikTok and influencers promoting pirated streaming for a one-time fee. Our reading: a pitch built on pirated streaming for a one-time fee is a reason to look harder at who made the box.

For an unrelated backdoor, see our guide to the [Claude Code extension VSCode backdoor and how to check and clean it up](/radar/claude-code-extension-vscode-backdoor).

### What to watch next

What are botnets in practice? In this case, a manufacturer, a firmware backdoor and a marketplace of buyers. Three things are worth following.

- **Google's new checks.** Google says it changed its certification review but withheld details. Any published specifics would show whether the post-first-boot gap is truly closed.
- **The real size.** Brundage calls 1.3 million highly conservative, and Google points to at least 10 million more devices tied to the affiliates. Watch Synthient's list for new models.
- **The rebound.** Google itself warns the market for backdoors and residential proxies remains resilient, so watch where the affiliates' modules turn up next.

## Frequently asked questions

### What's a botnet in cyber security?
In cyber security, a botnet is a network of internet-connected devices taken over by malware and controlled by one remote operator. Each device does a small job, such as relaying traffic or faking ad clicks, and the operator profits from the total. In XCPE, Google says the malware came preloaded on more than 1.3 million TV boxes.

### What are botnets used for?
Botnets are used to make money from devices their owners do not control. According to Google, XCPE's operators sold residential proxy access, ran ad fraud through modules called CBOXTV, HiddenView and Fission, and resold backdoor access to criminal affiliates who loaded their own code onto the boxes.

### Is my Android TV box infected?
It depends on the model. Google's post names no brands or models. Krebs on Security, citing Synthient, reports a pre-infected MECOOL box sold by Skyworth Technology, and Synthient keeps a GitHub list of affected models. In our reading, the most practical first step is to look up your exact model number on that list.

### What is a residential proxy?
A residential proxy routes someone else's internet traffic through a home connection, so it appears to come from an ordinary household instead of a data centre. Google lists residential proxy software kits, including AppSalt/Honeygain, NetNut/Popanet and GaGaNode, among XCPE's income streams, loaded through the preloaded backdoor rather than installed by owners.

### What legal action did Google take against Videostrong?
Google says it took legal action to take down the domains and servers Videostrong used to control the botnet, plus command domains of more than a dozen malware families. Its post does not name a court. Google also banned Videostrong and its future affiliates from building or supplying certified Android devices and from preloading Google apps.

### Should I stop using my Android streaming box?
9to5Google's view is that affected Android TV and Google TV boxes should be safe to use after the takedown, though owners may want alternatives. As general security practice, we would keep a listed model off your main network, change passwords used on it, and consider replacing it with a device from a reputable maker.

## Source
Based on Google Threat Intelligence Group's XCPE report. https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet

---
Published on SyntaxRadar (https://syntaxradar.com). Canonical URL: https://syntaxradar.com/radar/what-are-botnets-android-tv-boxes. Last modified 2026-11-04T17:00:00.000Z.