GoKawiilGoogle shuts down 1.3M-device Android TV botnet built on certified boxes
Google's Threat Intelligence Group dismantled x.cpe, a botnet that infected over 1.3 million Google-certified Android TV boxes, mostly sold under the MECOOL brand by Shenzhen-based Videostrong Technology. The malware used a backdoor to remotely install itself after devices went online, disabling Play Protect and evolving into a three-stage platform sold to third parties for residential proxying and ad fraud.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident suggests Google's device certification process, meant to assure safety for branded Android TV hardware, can be circumvented by manufacturers using obfuscation to hide post-sale backdoors. It raises questions about how much trust consumers should place in 'Google-certified' labeling and whether similar supply-chain compromises could affect other certified hardware categories.
- x.cpe infected over 1.3 million Google-certified Android TV boxes, mainly MECOOL-branded devices.
- Videostrong Technology allegedly used obfuscation to bypass certification checks and install malware post-sale.
- The botnet powered residential proxy networks and ad fraud, and reportedly let operators remotely control devices in real time.
Chromecast with Google TV (4K) — If this botnet story makes you wary of off-brand Android TV boxes, Chromecast with Google TV is an officially certified streaming device built and supported directly by Google, reducing the risk of hidden backdoors like the one found in these compromised MECOOL boxes. It gives you access to all the same apps and Google TV interface without relying on third-party manufacturers whose certification process can be fooled.}
See Chromecast with Google TV (4K) on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: arstechnica.com, 2026-11-03
Published there as: “Google dismantles botnet secretly running on 1.3 million Android TV boxes”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.