Google neutralizes botnet affecting 1.3 million Android TV devices

Google’s Threat Intelligence Group has successfully neutralized the 'x.cpe' botnet, a malicious operation that compromised more than 1.3 million Android-based television boxes. The devices, which were officially Google-certified, were primarily manufactured by Shenzhen-based firm Videostrong Technology under the MECOOL brand.

The breach highlights a significant gap in hardware certification processes. Although devices undergo security screening before receiving Google branding, researchers found that the malware employed obfuscation techniques to remain hidden during initial testing. The attackers utilized a remote backdoor, allowing them to inject the malicious software only after the hardware was activated by end-users.

Once active, the malware deployed a stub application, identified as 'x.cpe' or 'com.oemservice', which possessed system-level permissions. This allowed the botnet to install additional modules and deactivate Google Play Protect, the platform’s native security mechanism, preventing detection of subsequent malicious activity. The botnet reportedly operated as a modular platform, selling unauthorized access to third-party entities.

The incident underscores the ongoing challenge of managing security across the fragmented Android ecosystem, where device manufacturers often control firmware updates and system services independently of core software providers.