XCPE takedown: 1.3M TV boxes were resold as residential proxies
Published 2026-11-03 · By the ProxyFall team
On 2 November 2026 Google said it had worked with industry partners to shut down XCPE, a botnet of more than 1.3 million Android TV set-top boxes. According to Google's Threat Intelligence Group, the malware came preinstalled on boxes made by Videostrong Technology, and most often it rented the box's home internet connection out through residential proxy SDKs, besides running ad fraud. Google has cut ties with the manufacturer.
What happened
Google's Threat Intelligence Group describes a backdoor that Videostrong loaded right after a device's first boot (Google says that weakness is now fixed), then sold access to the infected boxes to criminal affiliates. Synthient, one of the partners, found the same malware and proxy components bundled on boxes sold under the MECOOL brand and published the affected model numbers. Plume, Black Lotus Labs and TrendAI contributed their own analyses.
Krebs on Security reports that infected boxes routinely downloaded the SDKs of several proxy monetization services, among them AppSalt/Honeygain (owned by Oxylabs), NetNut, EarnFM, Traffmonetizer, IPWeb and GaGaNode. Those services then resold the connections as residential IPs. Researchers say the takedown could also cut criminals off from more than 10 million other compromised devices, from healthcare gear to karaoke machines.
Synthient's founder Ben Brundage called it "probably the largest operation against backdoored TV boxes that we've seen."
What it means if you buy residential proxies
A pool fed by malware is a problem for the buyer, not only for the box owner. IPs that come from infected devices end up on blocklists and get high fraud scores quickly, so the sessions you run on them get challenged or banned, and you pay for the traffic either way. When a pool like this is taken down, the IPs that were kept alive by it disappear with it, so a provider's sticky sessions can drop or its pool can shrink for a while.
Ask your provider how its IPs are sourced and whether the people behind them agreed to it. Consent-based apps that pay users for bandwidth and backdoored firmware both produce "residential" IPs, and the sites you work on can often tell them apart faster than you can.
Check the IP before you rely on it. At ProxyFall, Find accurate IPs looks up the Scamalytics fraud score of every sticky IP it hands out and skips any that scores 60 or more (20 or more in strict mode), and Check shows the score of any residential line. Lines made in the generator are not screened automatically. Once a week we also open a random, unscreened sample of rotating lines and publish each IP's score on the Network quality page, so you can see the pool as it is rather than as we describe it.
Sources
Related: Residential proxies, Network quality: measured on our own network, Proxies for antidetect browsers.