Why is Google blocking 1.3 million Android TV boxes trending?
Google recently shut down a massive botnet called x.cpe that infected over 1.3 million Android TV boxes. The malware was secretly installed via a backdoor in devices manufactured by Videostrong Technology, a now-banned Google partner. These compromised devices were used for ad fraud, residential proxy networks, and unauthorized access.
What happened
- Earlier
Google's Threat Intelligence Group detected and disrupted the x.cpe botnet, cutting off Videostrong's access to 10 million compromised devices. Legal action was taken against their infrastructure. [1]
What you need to know
Affected devices include MECOOL-branded and 'white label' Android TV boxes of unknown origin. [1]
Most infected devices were in Brazil, Malaysia, Iraq, Mexico, and Taiwan, but tens of thousands were also in the US, UK, and other countries. [1]
Google has updated its certification process to close the loophole that allowed this malware. [1]
Even after disruption, affected devices still have disabled Play Protect and inert malware modules that can't be easily removed. [1]
It's unclear if all compromised devices are fully secure now, as residual malware components remain installed despite being inactive.
Background
The x.cpe botnet operated via a three-stage malware system, evolving since at least 2024. [2]
Videostrong sold access to criminal affiliates who used the network for ad fraud, residential proxies, and potential user surveillance. [1,2]
Google certified these devices initially, but Videostrong bypassed security using 'obfuscation techniques' and post-setup malware installation. [1]
Questions people ask
How can I check if my Android TV box is affected?
Check if you own a MECOOL device or a white-label Android TV box of unknown origin. Synthient published a list of 182 compromised models. [1]
Is my data safe now?
Google's actions should neutralize the threat, but affected devices still have disabled security features and residual malware that can't be easily uninstalled. [1]
Why did this happen?
Videostrong intentionally installed backdoors during manufacturing, then sold access to criminals. Google's certification process failed to detect this initially. [1,2]
Where this came from
[1] arstechnica.com
Google dismantles botnet secretly running on 1.3 million Android TV boxes
Preview image from arstechnica.com
[2] tomshardware.com
Certified Android TV manufacturer put unauthorized backdoor in 1.3 million set-top boxes, Google reveals — OEM sold access to criminal affiliates, used massive network as botnet for ad fraud, residential proxy
Preview image from tomshardware.com
Found through Google Trends and drafted with AI from at least two cited sources. Published automatically after passing our automated checks for sources, wording and safety. It may not have been reviewed by a person yet. Report a correction.