# EarnFM

Published articles for EarnFM.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies

DevFeed: [Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies](<https://devfeed.tech/articles/tech-firms-dismantle-botnet-that-turned-1-3m-tv-boxes-into-proxies-115665.md>)

Original publisher: [Read original article](<https://krebsonsecurity.com/2026/11/tech-firms-dismantle-botnet-that-turned-1-3m-tv-boxes-into-proxies/>)

Author: BrianKrebs

Published: 2026-11-03T02:24:31Z

Content type: news

Language: en

Sources: [Krebs on Security](<https://devfeed.tech/sources/krebs-on-security.md>)

Topics: [IoT botnets](<https://devfeed.tech/topics/iot-botnets.md>), [Internet of things](<https://devfeed.tech/topics/iot.md>), [pay-per-install](<https://devfeed.tech/topics/pay-per-install.md>), [malware protection](<https://devfeed.tech/topics/malware-protection.md>), [account takeover](<https://devfeed.tech/topics/account-takeover.md>)

Tags: [a-little-sunshine](<https://devfeed.tech/tags/a-little-sunshine.md>), [advertising](<https://devfeed.tech/tags/advertising.md>), [alarum-technologies](<https://devfeed.tech/tags/alarum-technologies.md>), [android-tv](<https://devfeed.tech/tags/android-tv.md>), [appsalt](<https://devfeed.tech/tags/appsalt.md>), [ben-brundage](<https://devfeed.tech/tags/ben-brundage.md>), [bmw-ipweb](<https://devfeed.tech/tags/bmw-ipweb.md>), [botnet](<https://devfeed.tech/tags/botnet.md>), [earnfm](<https://devfeed.tech/tags/earnfm.md>), [gaganode](<https://devfeed.tech/tags/gaganode.md>), [google](<https://devfeed.tech/tags/google.md>), [google-threat-intelligence-group](<https://devfeed.tech/tags/google-threat-intelligence-group.md>), [honeygain](<https://devfeed.tech/tags/honeygain.md>), [internet-of-things-iot](<https://devfeed.tech/tags/internet-of-things-iot.md>), [jaguar](<https://devfeed.tech/tags/jaguar.md>), [kimwolf](<https://devfeed.tech/tags/kimwolf.md>), [linkfog](<https://devfeed.tech/tags/linkfog.md>), [mecool](<https://devfeed.tech/tags/mecool.md>), [motion-picture-association](<https://devfeed.tech/tags/motion-picture-association.md>), [ne-er-do-well-news](<https://devfeed.tech/tags/ne-er-do-well-news.md>), [netnut](<https://devfeed.tech/tags/netnut.md>), [skyworth-technology](<https://devfeed.tech/tags/skyworth-technology.md>), [source](<https://devfeed.tech/tags/source.md>), [superbox](<https://devfeed.tech/tags/superbox.md>), [synthient](<https://devfeed.tech/tags/synthient.md>), [takedown](<https://devfeed.tech/tags/takedown.md>), [traffmonetizer](<https://devfeed.tech/tags/traffmonetizer.md>), [web-fraud-2-0](<https://devfeed.tech/tags/web-fraud-2-0.md>), [xcpe-botnet](<https://devfeed.tech/tags/xcpe-botnet.md>)

### AI overview

Google and industry partners dismantled the XCPE botnet, which enrolled more than 1.3 million Android TV boxes and may have connected to over 10 million additional compromised devices. Google says Videostrong Technology Co. used malware to sell infected devices' internet connections through residential proxy services, enable advertising fraud, and distribute affiliates' malware. The same malware was found in other Android IoT products, including telehealth devices, karaoke machines, and digital signage. Google took legal action against the domains and servers used to control XCPE and says it fixed a weakness that let malware load on first boot despite device security requirements. The report names several proxy providers linked to infected devices and cautions that affiliates also distributed their modules through channels beyond XCPE, so the 1.3 million figure may understate the wider impact.

### Source excerpt

Google said today it worked with industry partners to dismantle a botnet made up of more than 1.3 million Android TV set-top boxes that ship with malicious software which secretly rents the user's Internet connection out to strangers and conducts advertising fraud. Experts involved in the takedown say the action is likely to sever the botnet's access to more than 10 million additional compromised systems, including other Internet of Things (IoT) products such as Android-based healthcare devices and karaoke machines.