Google Dismantles Botnet Secretly Running on 1.3 Million Android TV Boxes

Google's Threat Intelligence Group has shut down a massive botnet called x.cpe, which ran on over 1.3 million Android TV devices. The malware-infected boxes were Google-certified, but the company's screening process missed the threat due to 'obfuscation techniques' used by Shenzhen-based Videostrong Technology. The compromised devices, mostly sold under the MECOOL brand, evaded detection by remotely installing the malware after setup and online activation. A stub application called x.cpe or com.oemservice would then phone home, allowing the installation of malware modules and disabling Play Protect to avoid detection. Google's certification process is designed to catch threats like this, but Videostrong's compromised boxes slipped through the cracks.