Tech

Google dismantles botnet secretly running on 1.3 million Android TV boxes

Read full article at source ↗

Based on a feed excerpt; full article content has not been acquired. Source evidence retrieved 03/11/2026, 17:28:23 UTC.

Briefings

Google's Threat Intelligence Group confirmed the shutdown of the x.cpe botnet, which operated on over 1.3 million Android TV devices. The malware was developed by Shenzhen-based Videostrong Technology and utilized obfuscation to evade detection. The botnet evolved from a single-stage dropper into a modular three-stage platform that sold third-party access. Devices sold under the MECOOL brand used a backdoor to install malware modules remotely after setup, bypassing Play Protect. Google's certification process failed to catch these threats, as manufacturers could not prevent remote installation. The incident occurred in 2026, with the botnet's peak activity involving compromised boxes.

Key points

• The x.cpe botnet operated on over 1.3 million Android TV devices, which were Google-certified boxes.
• Videostrong Technology developed the malware using obfuscation techniques to evade detection by Google's screening process.

Context

This incident occurred in 2026, revealing a gap between device certification and malware evasion. The botnet evolved from a single-stage dropper into a modular three-stage platform that sold third-party access. Manufacturers must have their devices certified to access Google apps and branding, but Videostrong's compromised boxes evaded detection by using a backdoor to install malware modules remotely after setup.

Limitations

Evidence is limited to the shutdown confirmation, device count, and technical details of the malware evolution. Specific dates of the botnet's peak activity are not provided, and the exact number of third-party access sales is not quantified. The source does not specify the geographic distribution of the affected devices or the total financial loss from the botnet's operations.

Generated by Bittrees-hosted qwen35-2b sha256:aaf42c8b7c3c on 03/11/2026, 18:28:55 UTC. Based on publisher-provided feed evidence; may not cover the full original article. Check the source for details.

View archived briefing on IPFS
bafybeide4mvfaq3gz3nsf3fztqrz3ra6gritcdbuhl26slul6n7yogmefe