Google said it dismantled a botnet spanning more than 1.3 million Android TV set-top boxes, and named the manufacturer as the operator. Videostrong Technology, a Chinese OEM/ODM, built the backdoor into devices it shipped and sold affiliates access to the machines.
Partners in the takedown believe it also severed contact with more than 10 million further compromised systems.
Not just televisions
The malware Google calls XCPE also appeared in telehealth devices, karaoke machines and digital signage. One device could run up to three residential proxy kits at once, plus ad-fraud modules firing fake impressions in hidden browser windows.
Named proxy software includes Linkfog, AppSalt, GaGaNode, BWM, Traffmonetizer, EarnFM and NetNut. AppSalt, owned by Honeygain, triggered its opt-in function without showing a consent screen, and disabled itself only when the host app came from Google Play.
A commercial operation, not a hobby
Configuration data showed per-module resource caps, per-architecture download links and priority weights, with devices sorted into six timezone pools. Operators managed command infrastructure through an EMQX console. Synthient, a startup tracking proxy providers, also found the same malware bundled on MECOOL boxes sold by Skyworth.
For buyers: treat a cut-price streaming box as a network device you do not control. Check the manufacturer against Google’s Android TV partner list, keep Play Protect running, and be sceptical of any app that pays for unused bandwidth.
