Google, in collaboration with industry partners, has successfully dismantled a botnet consisting of over 1.3 million Android TV set-top boxes, which were pre-loaded with malicious software. These devices, primarily manufactured by Videostrong Technology Co. in China, were used to rent out users' internet connections and engage in advertising fraud without their consent. The Google Threat Intelligence Group (GTIG) report revealed that the malware named XCPE turned these devices into nodes for residential proxy services, which are often used for anonymizing web traffic and can contribute to malicious activities such as account takeovers and ad fraud.

The GTIG report highlighted that the malware affected not only TV boxes but also other Android-based IoT products like healthcare devices and karaoke machines. Google severed ties with Videostrong and took legal action to dismantle the domains and servers controlling the botnet. Following this action, the botnet’s reach extended beyond the initial 1.3 million devices, potentially affecting over 10 million additional compromised systems.

Several residential proxy providers, including AppSalt (also known as Honeygain), NetNut, and others, were identified as having their software downloaded onto infected devices. This operation against Videostrong's botnet comes after similar efforts to combat other botnets like Kimwolf, which also exploited vulnerabilities in Android devices.

Synthient, a startup focused on tracking proxy providers, played a crucial role in this effort and previously published research into the Kimwolf botnet's activities. Their findings, along with Google's actions, led to a significant disruption of the malicious activities facilitated by these compromised devices. The takedown of the XCPE botnet represents a significant step in protecting users from malware distributed through seemingly benign consumer electronics.