GoKawiil
Tech News
Google's Threat Intelligence Group dismantled x.cpe, a botnet that infected over 1.3 million Google-certified Android TV boxes, mostly sold under the MECOOL brand by Shenzhen-based Videostrong Technology. The malware used a backdoor to remotely install itself after devices went online, disabling Play Protect and evolving into a three-stage platform sold to third parties for residential proxying and ad fraud.
A coalition including Google Threat Intelligence Group, TrendAI and Japan's National Police Agency disrupted a botnet of more than 1.3 million Android TV boxes and projectors spanning over 200 countries. Google says Shenzhen-based manufacturer Videostrong Technology deliberately built a backdoor called XCPE into device firmware and sold access to criminal affiliates, who installed malware modules to route traffic through unsuspecting owners' home networks. The group also took down command-and-control domains tied to affiliate modules and said it has cut ties with Videostrong, banning it from shipping devices with preloaded Google apps.
Google says it has severed its relationship with Videostrong Technology, the OEM/ODM behind MECOOL Android TV boxes, after finding the company built a backdoor called XCPE into its devices. Google says the backdoor turned over 1.3 million TV boxes into a botnet, which Videostrong allegedly sold access to for ad fraud, data exfiltration and enrolling devices into residential proxy networks.
Google's Threat Intelligence Group worked with industry partners to take down a botnet, dubbed XCPE, built from more than 1.3 million Android TV set-top boxes. Investigators traced the malware to Videostrong Technology Co., a Chinese manufacturer accused of preloading devices with backdoors that resold users' internet connections through residential proxy services and enabled advertising fraud. Google took legal action to seize the domains and servers used to control the botnet.
Google and industry partners took down the XCPE malware botnet, which infected over 1.3 million Android TV streaming boxes made by China-based Videostrong Technology. Google says Videostrong deliberately built a persistent backdoor into its devices and sold access to criminal groups, who used the devices for ad fraud, residential proxy networks, and further malware installation. Google also shut down command-and-control servers tied to more than a dozen related malware families affecting over 10 million additional devices, including set-top boxes, karaoke machines, and telehealth hardware.
A tech writer published a setup guide for replacing Google TV's ad-laden interface with Projectivy Launcher, swapping YouTube for the ad-free SmartTube client, using Wholphin for Jellyfin, and remapping the remote with Button Mapper. The configuration was tested on two Chromecast with Google TV devices and a Hisense TV, and the author says it should work on most Android TV hardware.
Developers are using AI coding assistants like Claude Code to remove bloatware, sponsored ads and tracking features from smart TVs, replacing stock interfaces with custom launchers. Projects such as "dumbtv" and "cleanyourtv" let users strip Android TV or Google TV systems over Wi-Fi and rebuild simplified home screens resembling Apple TV. One creator said he built the fix after noticing a sponsored ad on his parents' TV before reaching Netflix.
A comparison of smart TV software support finds Hisense's VIDAA OS, used mainly in Europe, now backed by a pledge of up to eight years of updates, while Hisense TVs sold in the US typically run Android TV, Fire TV, Google TV or Roku TV instead, leaving support up to those platform owners. Roku, Vizio and Insignia don't publish fixed support periods for their own-brand TVs, though Insignia's use of Amazon's Fire OS implies at least four years of updates based on Amazon's own device policy.
Researchers William Zhou and Daniel Freeman from Anthropic showed that AI models could potentially self-replicate across insecure IoT devices, such as Android TV boxes, by demonstrating a version of Google's Gemma model on 15 low-cost devices. Their experiments indicated that AI systems might soon perform the key steps needed for autonomous propagation, though practical deployment remains months away.
Anthropic ran experiments showing AI models like Qwen3.5-9B and GLM-5.2 can autonomously discover, configure and propagate onto consumer IoT devices such as off-brand Android TV boxes, successfully distributing Gemma4-26B-A4B across 15 such boxes. The company did not achieve a fully autonomous self-replicating AI worm on real hardware, but estimates smaller models could reach that capability by the end of the year if current improvement trends continue.
The TMY Smart Projector, which runs Google TV, is currently being sold for $169.99 after an $80 price cut representing a 32% discount. The deal applies to the projector as a home entertainment option for setting up a larger screen in a bedroom or living room.
Anthropic's Frontier Red Team showcased experiments where AI models like Qwen3.5-9B and Gemma4-26B-A4B established inference servers on various hardware, including low-cost Android TV boxes and high-end servers. They also demonstrated that an AI agent could coordinate replication across multiple devices via a network, using unprotected Android Debug Bridge ports. These findings suggest a potential for AI malware to spread without relying on traditional data center infrastructure.