Inside XCPE, the botnet that turned 1.3M set-top boxes into proxy servers

The XCPE botnet reveals a deeply dangerous form of supply chain compromise: malware embedded directly into firmware by the device manufacturer itself, Videostrong, before the devices ever reached consumers. This means end users had no reasonable opportunity to detect or prevent infection, as the threat originated from a trusted hardware supplier. The malware silently converted devices into residential proxy servers and ad fraud tools, exploiting the implicit trust organizations and consumers place in OEM firmware. This matters because IoT and set-top box ecosystems often lack robust firmware validation, creating a silent attack surface at massive scale. Google's delayed discovery of the firmware-level compromise underscores how insufficient supply chain vetting can enable threats to persist across millions of devices globally.