XCPE Botnet 2026: How 1.3 Million TV Boxes Became a Criminal Proxy Network—and What It Means for Enterprise Security
In November 2026, Google's Threat Intelligence Group and industry partners dismantled the XCPE botnet, a supply-chain malware operation orchestrated by Chinese TV box manufacturer Videostrong Technology Co. Over 1.3 million Android set-top boxes shipped with pre-installed backdoor malware that silently enrolled devices into residential proxy networks, enabling advertising fraud, account takeover, and anonymous criminal traffic routing. Google severed ties with Videostrong, took legal action against its command-and-control infrastructure, and coordinated with partners including Synthient to expose affiliated proxy services such as AppSalt/Honeygain, NetNut, and Grass. The takedown is estimated to sever access to more than 10 million additional compromised IoT devices globally. This incident underscores an accelerating threat trend: hardware supply-chain compromise at the manufacturer level, where malware is embedded before devices reach consumers. As IoT proliferation expands into healthcare, retail, and enterprise environments, the attack surface for botnet-as-a-service operations grows exponentially, demanding zero trust network controls and rigorous supply-chain vetting.
Kill Chain
