Google shuts down massive botnet infecting millions of Android TV boxes

Google's Threat Intelligence Group recently dismantled a massive botnet known as x.cpe, which compromised over 1.3 million Android TV devices. The operation involved Google-certified set-top boxes, primarily those sold under the MECOOL brand by Shenzhen-based Videostrong Technology. According to reports, the malware utilized a backdoor to remotely install malicious modules after initial setup, effectively bypassing standard security screenings through sophisticated "obfuscation techniques."

This security breach is significant because the infected hardware had already passed official certification processes designed to prevent such threats. The botnet functioned as a modular platform that sold remote access to third parties by leveraging system-level permissions and disabling Play Protect. To mitigate potential risks, businesses are advised to "quickly check whether they are affected, install fixes and protect important systems and data.