Tech Firms Dismantle Massive Botnet Embedded in 1.3M Android TV Boxes

Tech companies and security researchers have dismantled a massive botnet comprising more than 1.3 million Android TV set-top boxes that secretly rented out users' internet connections and executed advertising fraud. According to Krebs on Security, the coordinated takedown severed access to an estimated 10 million additional compromised internet of things (IoT) devices, including healthcare gadgets and karaoke machines.

What happened

Google’s Threat Intelligence Group (GTIG) reported that it severed ties with Videostrong Technology Co., a China-based TV box manufacturer identified as the source of the malware. Krebs on Security reports that Videostrong embedded the "XCPE" malware directly into devices, which loaded immediately upon first boot to turn user internet addresses into commercial residential proxies. These proxy services were subsequently utilized for web traffic anonymization, account takeovers, mass content scraping for AI projects, and ad fraud.

Google took legal action to seize the domains and servers used to control the XCPE botnet. According to the reporting, Videostrong monetized the backdoor by selling access to criminal affiliates. Research from startup Synthient additionally revealed that pre-infected devices, such as those sold under the MECOOL brand by Skyworth Technology, bundled the Videostrong malware alongside software development kits for residential proxy providers like AppSalt (Honeygain), NetNut, and Grass. Many of these tainted devices gained widespread distribution through social media influencers on platforms like TikTok and YouTube.

Why it matters for small AI and tech teams

For small companies deploying AI agents, scraping public web data, or routing automated workflows through cloud and edge infrastructure, the XCPE botnet takedown is a stark reminder of the compromised nature of proxy ecosystems. As Krebs on Security details, residential proxy networks are heavily leveraged for mass content scraping to feed AI projects. When proxy providers unknowingly or knowingly integrate with supply chain backdoors like those built by Videostrong, commercial AI pipelines risk routing requests through hacked consumer hardware.

Small teams relying on third-party proxies for data collection or market intelligence face significant compliance and cybersecurity vulnerabilities. If your AI agents scrape data or interact with web services using tainted proxy pools, your organization risks having its IP addresses blacklisted, encountering fabricated data from automated ad fraud loops, or inadvertently participating in criminal traffic redistribution. Securing your agentic infrastructure requires rigorous vetting of data vendors to ensure they do not source residential IPs from compromised consumer hardware.

What to do this week

1. Audit all third-party data providers and proxy services your team uses for web scraping or AI data collection to verify their IP sourcing transparency and compliance standards.
2. Review network access controls and egress filtering rules for any company-owned IoT hardware, smart displays, or media devices connected to your primary office network.
3. Check your organization's internal threat intelligence feeds against newly published industry lists—such as Synthient’s affected device model numbers—to ensure no backdoored streaming boxes are operating locally.

Sources

• Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies — Krebs on Security