Videostrong supply-chain malware turned 1.3 million Android TV boxes into XCPE residential proxies

The takedown removed domains and servers used by Videostrong to enroll devices into residential proxy pools sold to multiple criminal affiliates. Infected boxes ran modules from providers including Honeygain, NetNut, EarnFM and Traffmonetizer, enabling ad fraud, account takeover and content scraping. The same XCPE loader also reached telehealth units, karaoke machines and digital signage, expanding the pool beyond the initial 1.3 million TV boxes to more than 10 million additional Android IoT endpoints.

Procurement records and compatibility-test bypasses show Videostrong shipped devices with the backdoor active on first boot, bypassing Google’s post-manufacture security checks. This matches the July 2026 FBI seizure of NetNut domains tied to the Popa botnet and Synthient’s January 2026 tracking of the Kimwolf proxy campaign, indicating a repeatable pattern of hardware-level proxy monetization rather than opportunistic infection after sale.

The action exposes a structural weakness: residential proxy economics reward manufacturers who pre-install access. Expect further domain seizures and SDK blacklisting against remaining providers named in the GTIG report within the next quarter as enforcement scales to other Android IoT supply chains.