Pull to refresh
Logo
What Changed
Following Why Sign Up
Google-led coalition cuts off botnet hidden in Android TV boxes

Google-led coalition cuts off botnet hidden in Android TV boxes

Force in Play

A manufacturer pre-installed a backdoor on set-top boxes, then sold access to criminal affiliates.

6 days ago: Proxy provider Oxylabs cuts off a supplier

Overview

Updated 4 days ago

Google and a coalition of security firms said on November 2 that they had cut the operators of a hidden Android TV backdoor off from the servers controlling more than 1.3 million devices. Google banned the manufacturer, Shenzhen-based Videostrong, from building certified Android devices.

Japan's National Police Agency said the case surfaced in September 2025, when Fukuoka prefectural police investigating an unauthorized bank transfer found infected devices. The agency linked 1,918 unauthorized bank transfers in 2024 to residential proxies, with losses of about ¥2.89 billion ($18.3 million). On November 5, proxy provider Oxylabs said it had suspended a supplier tied to the malware loader and would tighten checks on app builds.

Why it matters

The command servers are down, but the backdoor stays on every infected box, and the proxy supply chain that carried it is still running.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

What services were using the botnet?

The botnet powered residential-proxy and bandwidth-selling services, ad-fraud operations, and a pipeline for loading further malware — all running on victims' devices without consent.

Renting clean residential IPs lets criminals pass fraud checks and geo-filters as if they were ordinary home users, and advertisers pay for fake views generated from real households.

4 details3 sources1 disagreement
  • Videostrong's loader (com.abc.nexus) pulled modules including Linkfog/Dianxinyun, AppSalt/Honeygain, NetNut, TraffMonetizer, Grass and ADMOYU, which turned boxes into proxy exit nodes or PCDN bandwidth sellers.
  • Ad-fraud modules such as CBOXTV, HiddenView and DevourService generated ad impressions from roughly 1.33 million set-top boxes; TrendAI counted 3,849,226 distinct residential exit IPs from June 3 to October 1, 2026.
  • Some devices ran as many as three residential-proxy SDKs at once, and extra backdoors (Moyu, Spirit) loaded even more monetization modules onto the same boxes.
  • Infected devices spanned Android TV boxes plus telehealth gear, karaoke machines and digital signage across at least 170 countries.
Google Cloud Blog TrendAI Trend Micro Newsroom
Room for disagreement
  • Coverage differs on the bandwidth-sharing firms: Google and TrendAI describe Linkfog and Dianxinyun as legitimate pay-for-traffic services that were abused by enrolling devices without owner consent, not as malicious operations themselves.
0 AI answers with web search. May be wrong.

Key Indicators

1,472,554
Infected devices observed
TrendAI's telemetry count across 206 models from June to October 2026.
206
Device models affected
White-label Android TV boxes carrying the pre-installed backdoor.
170+
Countries reporting infected devices
Malaysia, Brazil, Iraq, Mexico and Taiwan recorded the most devices.
1.33 million
Devices scheduled for proxy and ad-fraud modules
About nine in ten controlled devices were actively monetized.
3,849,226
Distinct residential exit IP addresses
The proxy product offered about 182,000 household IPs on a typical day.
10 million
Additional devices reachable via affiliate networks
Google says disrupting affiliate command domains could sever access to these devices.
2.36 billion
Control messages captured
Instructions sent to infected devices during the measurement window.
1,918
2024 bank transfers tied to residential proxies
Japan's National Police Agency linked these unauthorized transfers to proxies, with losses of about ¥2.89 billion.

Voices

Curated perspectives — historical figures and your fellow readers.

Sign up to generate historical perspectives on this story.

Log in Sign Up

Organizations Involved

Google
Google
Technology company
Led the takedown; banned Videostrong from certified Android devices

Alphabet's Google runs the Android and Android TV ecosystems and certifies devices that carry its apps.
Videostrong Technology Co.
Videostrong Technology Co.
Android device manufacturer (OEM/ODM)
Banned from building certified Android devices

A Shenzhen-based manufacturer that builds Android TV boxes for white-label brands.
TrendAI
TrendAI
Cybersecurity research firm (Trend Micro)
Measured the botnet and helped disrupt it

The research arm of Trend Micro, which tracked the X.CPE operation from June to October 2026.
JN
Japan National Police Agency
Law enforcement agency
Partner in the takedown; detailed the case's origin on November 5

Japan's national police force, which joined the coalition disrupting X.CPE infrastructure.
Lumen Technologies
Lumen Technologies
Telecommunications and cybersecurity company
Partner in the takedown

A network and security company that contributed threat intelligence to the coalition.
OX
Oxylabs
Residential proxy provider
Suspended a supplier tied to the X.CPE loader and is tightening app checks

A residential proxy provider that says it cut off a supplier linked to the com.abc.nexus malware loader.

Timeline

2024 November 2026

7 events Latest: 6 days ago
Tap a bar to jump to that date

  1. Proxy provider Oxylabs cuts off a supplier

    Latest Corporate response

    Oxylabs said it suspended a supplier tied to the com.abc.nexus loader and would improve build fingerprinting after the developer faked consent signals.

  2. Japan police detail how the case surfaced

    Investigation

    The National Police Agency said Fukuoka prefectural police found infected devices in September 2025 while investigating an unauthorized bank transfer, and the Kanto Regional Police Bureau traced their manufacture and reported to Google.

  3. Coalition announces takedown and Videostrong ban

    Takedown

    Google, security firms and Japan's National Police Agency cut off command servers and ban Videostrong from certified Android devices.

  4. Japan's NPA warns on residential proxy risk

    Government advisory

    The agency warned that smart TVs, routers and network cameras could be turned into residential proxies and urged consumers to avoid apps and free VPNs from unverified providers.

  5. TrendAI begins tracking the operation

    Investigation

    Researchers start measuring the botnet, eventually counting 1,472,554 infected devices across 206 models.

  6. Related BADBOX 2.0 botnet disrupted

    Takedown

    A botnet in the same device ecosystem is disrupted, but the underlying supply chain persists.

  7. Videostrong malware goes modular

    Malware evolution

    The pre-installed malware shifts from simple droppers to a three-stage architecture built for resilience and multi-tenant monetization.

Scenarios

1

Operators rebuild command servers within months

Likely Resolves by May 2, 2027

Discussed by: TrendAI and Google threat intelligence

TrendAI notes that operators of this kind have rebuilt on new infrastructure before. The implant remains on every infected box, so a new command server could re-enroll devices that are still online. The trigger is a new domain or message broker serving x.cpe traffic.

2

Affiliate malware networks stay offline

Possible Resolves by Feb 2, 2027

Discussed by: Google Cloud threat intelligence

Google took legal action against command domains used by more than a dozen affiliate malware families, which it says could sever access to at least 10 million additional compromised devices. If the domains stay down and no replacements appear, the affiliates lose a distribution channel.

3

Videostrong or a subsidiary returns to certified Android

Unlikely Resolves by Nov 2, 2027

Discussed by: Google's certification policy

Google banned Videostrong and any future subsidiaries or affiliates from building certified Android devices. The test is whether a related entity reappears on Google's certified-partner list under a new name.

4

Regulators open enforcement action against Videostrong

Uncertain Resolves by Nov 2, 2027

Discussed by: No named party; no regulator has announced action

The takedown was led by a private company and a police agency, not a regulator. A government agency could open a formal investigation or file a complaint over the pre-installed malware. No such action has been announced.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

2025

BADBOX 2.0 takedown (2025)

A botnet of infected Android devices, including TV boxes, was disrupted. It had been used for ad fraud and proxy services across many countries.

Then

Command servers were cut off and the operation was disrupted.

Now

The infrastructure and actors overlapped with later campaigns, and the ecosystem persisted.

Why this matters now

TrendAI places X.CPE in the same ecosystem as BADBOX 2.0, showing that takedowns do not end the underlying supply chain.

2016

Mirai botnet (2016)

Malware infected internet-of-things devices using default credentials and built a botnet that launched massive denial-of-service attacks, including one that knocked major websites offline.

Then

The source code leaked and variants spread quickly.

Now

It established the playbook for monetizing poorly secured consumer devices.

Why this matters now

X.CPE follows the same logic: consumer hardware with weak security becomes a rentable attack surface.

2018

VPNFilter router takedown (2018)

The FBI seized a domain used to control VPNFilter, malware infecting hundreds of thousands of home routers.

Then

Control infrastructure was disrupted, but devices remained infected.

Now

Domain seizure became a standard takedown tool, with the same limitation.

Why this matters now

The X.CPE takedown has the same shape: sever the servers, leave the implant in place.

Sources

(10)
+4
PR Newswire Google Cloud Blog TrendAI Security The Register The Verge 9to5Google The Japan Times Krebs on Security Malaysian Wireless Plume