GoKawiilGoogle dismantles 1.3-million-device Android TV box botnet linked to Videostrong
Google's Threat Intelligence Group worked with industry partners to take down a botnet, dubbed XCPE, built from more than 1.3 million Android TV set-top boxes. Investigators traced the malware to Videostrong Technology Co., a Chinese manufacturer accused of preloading devices with backdoors that resold users' internet connections through residential proxy services and enabled advertising fraud. Google took legal action to seize the domains and servers used to control the botnet.
GoKawiil's interpretation of the reporting above, not reported fact.
The takedown could cut off access to more than 10 million other compromised IoT devices, including medical equipment and karaoke machines, suggesting the botnet's infrastructure was far more widely shared than the TV boxes alone. Google's characterization of a manufacturer deliberately infecting its own customers highlights a growing concern that supply-chain compromises in cheap IoT hardware are becoming a direct channel for cybercrime and AI-driven scraping. The case may prompt renewed scrutiny of device manufacturers' security practices, particularly for low-cost hardware sourced from China.
- Google and partners dismantled the XCPE botnet of 1.3 million+ Android TV boxes.
- Chinese manufacturer Videostrong is accused of preloading devices with malware to sell proxy access.
- The action may also disrupt access to over 10 million other infected IoT devices.
Google Chromecast with Google TV — This article is a great reminder that cheap, unverified Android TV boxes can come bundled with hidden malware turning your device into part of a botnet. Switching to a reputable streaming device like Chromecast with Google TV, backed by Google's security updates and app vetting, is a safer way to enjoy streaming without the proxy-hijacking risks described here.
See Google Chromecast with Google TV on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: krebsonsecurity.com, 2026-11-03
Published there as: “Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.