On November 2, 2026, Google's Threat Intelligence Group published its teardown of XCPE, a backdoor built into the firmware of more than 1.3 million Android TV set-top boxes. Google says, with high confidence, that the manufacturer itself wrote it: Videostrong Technology Co., a Shenzhen original design manufacturer whose boxes sell under brands such as MECOOL. The week before, Google and partners including Lumen, HUMAN Security, Plume, Synthient, TrendAI and Japan's National Police Agency took down the domains and servers behind it, and Google banned Videostrong from the certified Android program.
The detail that matters for anyone who scores traffic by IP address sits a few paragraphs into Google's report. Among the modules Videostrong's affiliates pushed to the boxes were eight residential proxy SDKs, and a single box could run as many as three of them at once. One living-room address was for rent, at the same moment, through several proxy brands that do not share a pool, a parent company or a customer list.
The backdoor shipped in the system partition and survived uninstall
Videostrong's component is a package called x.cpe (sometimes com.oemservice). It is preloaded into the firmware's system partition and runs as android.uid.system, so the user cannot remove it. Delete it from /data/app/ and a boot receiver reinstalls it from the /oem/ partition on the next restart. Google's compatibility and security tests passed because Videostrong obfuscated the code and loaded the malicious part only after the device's first boot.
Since at least late 2024 the design has had three stages. x.cpe talks to the command server and hands work to a loader, com.abc.nexus, which carries native anti-analysis code and a seccomp filter (libseccomp_guard.so) that blocks attempts to pause or kill its threads. The loader then installs the monetization modules: native ELF daemons, embedded SDKs or secondary APKs written by the affiliates who paid Videostrong for access. From August 2026 newer droppers posed as system apps such as com.android.system.ntp, restarted adbd as root, remounted /system read-write and installed themselves into /system/priv-app/.
Google is blunt about the business model. Videostrong "seeks to monetize every infected device to the greatest extent possible," and the proof is the duplication: a box running three SDKs that all do the same job earns three payouts for the same upstream bandwidth. Google also estimates that cutting the affiliates' command domains severs their access to at least 10 million more devices infected through other channels.
Eight SDKs, one address
The eight bandwidth-sharing components Google pulled from the boxes, with how each one phones home:
- AppSalt, the SDK of Honeygain, which is owned by Oxylabs: WebSocket command channel, UDP and QUIC relay.
- NetNut/Popanet: identical to the malware in Google's July 2026 NetNut disruption, its command infrastructure already taken down.
- GaGaNode, the first-party SDK of IPCola: initializes both the NetNut/Popanet client and the EarnFM Fleet SDK.
- EarnFM (Fleet SDK): persistent WebSocket with TCP and UDP relay.
- Traffmonetizer: a single multiplexed WebSocket over TLS.
- Linkfog, operated by Beijing Linkfog Technology: a Go binary that connects to FRP reverse tunnels.
- Jaguar: a native library,
libjaguar.so, with an encrypted channel relaying TCP and UDP. - BWM/IPWeb: a Java NIO TCP proxy tunnel.
Look at GaGaNode. One SDK on the box starts two other vendors' clients, so a single install feeds three pools before Videostrong adds a second or third module. The brand a proxy customer pays is further away still. Brian Krebs traced the corporate layer: Honeygain and Oxylabs were reorganized in October 2026 under an umbrella called Source, after Oxylabs took $130 million from Warburg Pincus in July; NetNut belongs to the publicly traded Israeli company Alarum Technologies. Synthient's Ben Brundage told Krebs the boxes also carried the Grass proxy software, which is not among the eight SDKs Google describes.
Oxylabs responded to Krebs on November 5. It said it had no record of a company called Videostrong but did find a supplier shipping com.abc.nexus, the loader Google lists as malware, and that "this supplier accounts for less than 1% of our IP address pool." It had a signed contract with that supplier, had seen a consent flow during QA, and has now suspended the relationship. Even one percent of a pool the size of Oxylabs' is not a rounding error, and that is a single brand's view of a single supplier.
Consent was a method call
Residential proxy brands market themselves as ethical because the device owner opted in. Google shows what the opt-in looked like on an XCPE box. The backdoor first wipes the user's consent configuration and disables Google Play Protect. Then, in Google's words, the "Appsalt SDK is initialized without displaying a consent screen - instead it explicitly calls the optIn() method which sets a consent flag without displaying any user interface." The SDK does include a check that stops it when the host app came from the Play Store, which an app baked into firmware never did.
Oxylabs told Krebs its system is designed so a device cannot become an exit without a consent signal, and that the developer faked that signal. Both statements are true, and together they describe the problem: the signal is a boolean set by the same code that wants the payout. Google's report draws the general conclusion itself: "Silent opt-in without user consent remains the most prevalent means by which devices are turned into exit nodes." An "ethically sourced" pool is one where every supplier promised to show a dialog.
The control plane sat in datacenters, the exits in living rooms
Google published the infrastructure, and it splits neatly. Devices bootstrapped against *.anyevonline.com on port 8000 (MECOOL boxes, identified by the ro.mecool.device property, used their own hostname), then held an MQTT session to mqtt.szbboys.com on ports 3885 to 3887. Linkfog's agent used FRP reverse tunnels, a standard Go tool for exposing a device behind NAT, which is exactly the problem every proxy SDK has to solve. Public BGP data places the operator side in three networks:
| Role | Address | Covering route | Origin AS | Holder |
|---|---|---|---|---|
| MQTT broker (mqtt.szbboys.com) | 219.134.163.210, .211 | 219.128.0.0/13 | AS4134 | China Telecom backbone |
| Operator file server | 38.145.197.135 | 38.145.196.0/23 | AS18978 | Enzu Inc |
| Operator file server | 23.94.49.57 | 23.94.48.0/21 | AS36352 | ColoCrossing |
Enzu and ColoCrossing are hosting providers, and the Shenzhen broker sat on China Telecom. None of these addresses is what a targeted site sees in its logs. The traffic a proxy customer bought left the boxes directly, through the SDK vendors' own gateways, from whatever consumer ISP the box was plugged into. TrendAI put the largest concentrations in Malaysia, Brazil, Iraq, Mexico and Taiwan, with the United States, Germany, the United Kingdom, Australia and Canada each at about 26,000 to 42,000 infected devices between June and October. Blocking the command infrastructure protects the boxes. It does nothing for the sites those boxes were relaying requests to.
Why "which provider" is the wrong question
Proxy detection vendors like to publish which brand an exit belongs to. On an XCPE box the answer can be three brands at once, plus whichever resellers each of them wholesales to. A customer of Honeygain's pool and a customer of EarnFM's pool could send requests through the same address in the same minute, and two site owners comparing notes would conclude they were looking at different threats.
The useful fact is smaller: right now, this address relays traffic for strangers. Which brand booked the sale is a billing detail. That has two consequences for how a residential proxy flag has to be built.
It has to be per address. The ASNs involved are consumer ISPs in Malaysia, Brazil, Iraq, Mexico, Taiwan and the United States, and the infected boxes are a sliver of each. A flag on the ASN, or on a /24, punishes the neighbors. Our data sets security.is_residential_proxy on the single address where an exit was observed, through real subscriptions to these services plus inference, and leaves the rest of the block alone. We described the same shape when six White House addresses turned up for rent last week.
It also has to be dated. Each sighting is a timestamp, not a property of the address. Consumer ISPs hand out leases that change, the household behind an address moves, and the box gets unplugged. Synthient's advice to owners is to throw the hardware away. A flag that never expires turns into a penalty on whoever inherits the address.
To be fair, the takedown does not reset all of this. Google took down Videostrong's servers and the command domains of more than a dozen affiliate malware families. Oxylabs says it suspended the supplier; NetNut's command servers have been down since July; we have found no statement from the other six on what happens to installs that are already running. Until there is one, a box bought in 2025 is still a candidate exit, and the only way to know is to keep observing.
What to do with an ASN that is 99% subscribers
Do not block the network. A Malaysian or Brazilian consumer ISP with a few thousand XCPE boxes among millions of lines is still, address by address, almost entirely real people, which is why proxy customers pick those ISPs in the first place. Read the per-address flag at the moment of the sensitive action, and treat a positive as a reason for a step-up (a second factor, a hold on a payout) rather than a refusal.
Expire what you cache. A verdict stored at signup is worth little a week later on a residential lease, in either direction. Log the ASN and the flag side by side, so a dispute file can show the address was a known exit at that hour rather than merely a home ISP line.
If you run a network with TV boxes on it, Synthient advises confirming with an online lookup that your public address is not being misused as a residential proxy (its own check page reports on the address you visit from), and the Google report lists the hostnames to search your DNS logs for: anyevonline.com, szbboys.com, intermedia-arts.tv and yokatvonline.com. A match means a box on your network takes orders from Shenzhen, whatever it is doing for the proxy brands this evening.
Ipregistry returns the network context and the per-address behavior in one response: connection type, company and ASN alongside separate flags for proxies, residential proxies, VPNs, Tor and relays, with the residential proxy flag set per address rather than inherited from the block. You can run your own traffic through it with 20,000 free lookups to get started.
Keep users in the loop Ship release notes that get read. Try Noticeable