Every CTV report you signed off this autumn rests on three quiet assumptions. The device was a real streaming device. The impression beacon fired because an ad played. The third-party tracker you pay for fired because it saw the same thing. On November 2, Google’s Threat Intelligence Group published a report showing that all three could be produced by the box itself, with nothing on the screen.
The box in question was not a knockoff from a market stall. It was certified Android hardware, and Google says its maker built the fraud in on purpose. Holiday CTV flights are live and Black Friday is November 27, so this is the week to put a few pointed questions to your vendors and tighten where the streaming money goes. Not to pull it.
What Google found inside the box
Google says that it and a group of industry partners dismantled a backdoor called XCPE, which had enrolled more than 1.3 million set-top boxes in a botnet. It assesses “with high confidence” that the backdoor and botnet were “intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.,” an Android device manufacturer. Videostrong sold access to criminal affiliates and loaded their software onto the boxes. The report’s verdict is unusually blunt: “We believe this campaign wasn’t an isolated rogue insider or a development oversight.”
The certification detail is the one marketers should sit with. Google requires device makers to pass compatibility and security tests before they ship with Google apps. Videostrong, per the report, “employed obfuscation techniques to exploit a gap in our tests and load malicious code after the device’s first boot.” Ars Technica, reporting on November 3, describes them as Google-certified boxes, mostly sold under the MECOOL brand. Google has banned Videostrong and any future subsidiaries from certified Android devices and says it changed its review process. It has not said how.
Scale depends on who is counting. TrendAI, one of the partners, counted 1,472,554 infected devices, according to Ars Technica, with the heaviest concentrations in Brazil, Malaysia, Iraq, Mexico and Taiwan. CyberScoop, citing the same researchers, puts nearly 44,000 infected devices in the United States between June and October. Google adds that taking down the affiliates’ command servers cuts off at least 10 million more compromised devices that those affiliates reached through other channels.
A view with nothing on screen
Most of the money in XCPE came from renting out home internet connections, and we will get to that. The ad fraud modules are the part that should change how you read a CTV report.
One module, which Google calls Fission, lived inside ordinary video apps. Instead of showing an ad, it ran in the background, asked ad servers for placements, pulled the primary impression beacons and the third-party tracking URLs out of the response, and then “immediately fires HTTP GET requests to each tracking endpoint to register a fake ad view without displaying creative content.” Inside two smart TV app stores, it called the ad SDK directly “to report synthetic ad exposures.” A second module, HiddenView, used transparent overlays and hidden browser windows to scroll, click, type and play media for an audience of nobody.
Read that from the buyer’s chair. The impression pixel and the verification tag are your receipts. Here the receipts were printed without a sale. A verification vendor that sees its tag fire from a genuine device on a home broadband line is looking at precisely what this operation was built to manufacture.
Google’s report does not name a single ad network, exchange, publisher or advertiser that paid for these views, a gap PPC Land also flagged in its November 8 write-up. That cuts both ways. Nobody can tell you your budget was hit. Nobody has told you it wasn’t.
A real device is a low bar
The industry’s most recent answer to CTV fraud was to prove the hardware is genuine. In October 2025, IAB Tech Lab added device attestation to its Open Measurement SDK, so a device manufacturer can vouch, through a privacy-preserving token, that an impression came from a real device. At launch it worked on Apple devices and Fire TV. Anthony Katsur, IAB Tech Lab’s chief executive, said at the time that with attestation buyers “can be confident the inventory they are measuring is real.”
That solves spoofing, where a server in a data center pretends to be a television. It was never meant to solve this. When AdExchanger covered the launch, HUMAN’s Geoff Stupay pointed out that attestation does not stop a bad actor from using legitimate devices to create fraudulent impressions, and that verification firms would still need other signals to tell whether a screen was on and someone saw the ad.
XCPE is that warning at full scale. The boxes were real. They passed a platform’s certification. The manufacturer was the fraud. A signature from the maker tells you what the box is, and nothing about whose side the maker is on. So device provenance turns into a buying question: which makes, which app stores and which apps your impressions actually came from, and whether anyone measured an ad that rendered rather than a URL that fired.
Home addresses stopped proving a household
Google says the most common modules turned boxes into residential proxy exit nodes, sometimes with three proxy kits running on a single device. Plume’s release on behalf of the partners describes the effect plainly: outside traffic passed through subscribers’ connections “using their home internet addresses and bandwidth without permission.” Google found one proxy kit that set the user consent flag without ever showing a consent screen.
This reaches well beyond CTV. A lot of quiet logic in ad tech and marketing ops treats a home broadband address as a sign of a real person. Data center traffic tends to get filtered as invalid, while home traffic gets the benefit of the doubt. Lead scoring trusts it. A good share of CTV attribution matches a TV impression to a later website visit from the same household address. Residential proxies exist to sell exactly that look. TrendAI’s Robert McArdle summed up what the boxes were used for as “defrauding advertisers or piggybacking on their connections to carry out other attacks via residential proxies.” If any report you rely on uses a household IP as proof of anything, it is worth knowing how it treats known proxy exit nodes.
Why it lands on the Q4 plan now
Streaming is where the incremental money is going. Magnite, one of the biggest sell-side platforms in CTV, reported that its CTV revenue rose 39% year over year in the third quarter and now makes up 53% of its business, AdExchanger noted on November 6. Holiday flights are booked. Your June to October invoices are likely settled. Credits for invalid traffic found after billing depend on contract terms and vendor goodwill, and both are easier to use while the takedown is fresh and every verification company is running its own lookback.
It is also the second time this autumn that a measurement layer marketers treat as neutral turned out to be manufactured. In October it was rank trackers being fed poisoned search results. Now it is the receipts behind streaming impressions.
Google is clear that this is not finished. Backdoor operators, ad fraud rings and proxy providers “operate as an interconnected supply chain,” the report says, and “when one component is disrupted, operators quickly pivot to new loaders or rival monetization SDKs.” The next box is probably already on a shelf. Treat this as a permanent change in what CTV proof means, not a one-week scare.
None of it is a reason to pause streaming. Premium CTV bought from named publishers and major device platforms is a different animal from a long-tail app on a generic Android box. The job is to know which one you are buying, and to be able to show it.
What to do this week
Send three written questions to your DSP, SSP and verification vendor. Did any of our impressions since June come from devices, apps or IP addresses tied to XCPE or the affiliate modules in Google’s November 2 report? How much was filtered as invalid, and how much was billed? What credit process covers invalid traffic identified after invoicing, and by what date do we need to claim it?
Pull CTV delivery by device make, operating system and app, June to today. Flag generic Android TV boxes, unknown makes and apps nobody on the team can name. Global brands should look hardest at Brazil, Malaysia, Mexico and Taiwan, where TrendAI found the densest infections.
Steer holiday CTV toward supply you can name. Favor direct and private marketplace deals with known publishers and device platforms, inventory measured through Open Measurement, and attestation where it exists. Treat attestation as a floor that rules out spoofing, not as proof a person saw the ad.
Audit every place a home IP counts as evidence. That means CTV-to-web attribution, lead scoring, and promo or sign-up abuse rules. Ask each vendor how they handle residential proxy traffic and whether their lists changed after the takedown.
Write device provenance into the next insertion order. Ask for device-level log access, an invalid traffic clawback window that outlasts the invoice, and a named person on the vendor side who owns fraud questions.
Agencies, run one sweep across every client. The same three questions, one device report per advertiser, and a single summary of which clients bought long-tail CTV through open exchanges since June. Clients will ask. Having the answer ready before they do is the whole job this month.
Brief finance and the CMO in two sentences. A certified device maker faked ad views through boxes in more than 170 countries, and there is no evidence yet that our money was involved. We are asking our vendors for proof either way. Better they hear that from you than from the trades.
The old fear in CTV was a server pretending to be a television. The new one is a television that tells the truth about being a television and lies about everything else. Buy like you know the difference.
