Google Killed a Botnet Living on 1.3 Million Certified Android TV Boxes

Google's Threat Intelligence Group has dismantled a botnet called x.cpe that, at its peak, was quietly running on over 1.3 million Android TV devices. The uncomfortable part? These were Google-certified boxes. Boxes that passed Google's own screening process.

The manufacturer responsible is Shenzhen-based Videostrong Technology, which sells hardware primarily under the MECOOL brand. According to Google, Videostrong used obfuscation techniques to get its devices through certification clean, then installed the malware remotely after the boxes were already in customers' homes and connected to the internet. Neat trick.

The infection mechanism was a stub application, listed as x.cpe or com.oemservice, which sat dormant and innocent-looking on the device. It had no malicious functionality itself, but it carried system-level permissions that let it silently pull down and install malware modules on command. It also killed Play Protect, which would otherwise have thrown up red flags about the packages being installed in the background.

Once compromised, the devices were primarily used for two things: residential proxy services, funnelling sketchy traffic through real home IP addresses, and ad fraud. Videostrong apparently also kept full administrative access for itself, with the ability to run terminal commands, capture device screens, and probe other devices on the same local network. Google says it watched Videostrong doing exactly this, in real time.

Taking it down required a cross-border effort. Google partnered with Japan's National Police Agency, cybersecurity firm Synthient, and Trend Micro to go after the infrastructure. Legal action was taken to seize the domains and servers Videostrong used for both malware distribution and command-and-control. Google estimates the operation severed Videostrong's reach from around 10 million compromised devices in total, suggesting the x.cpe botnet was just one slice of a larger campaign.

Trend Micro's count put the confirmed infected Android TV devices at 1,472,554. Most were concentrated in Brazil, Malaysia, Iraq, Mexico, and Taiwan, though tens of thousands were also found in the US, UK, Germany, Australia, and Canada.

For people who already own one of these boxes, the news is mixed. The botnet infrastructure is gone, but Play Protect is still disabled on affected devices, and the dormant malware modules remain installed as system apps, which means ordinary users cannot remove them. Synthient has published a list of 182 device model names confirmed to be part of the botnet. If you have a MECOOL box or any generic white-label Android TV device of uncertain origin, it is worth checking against that list.

Google has terminated its relationship with Videostrong entirely. The company and any subsidiaries are now barred from using Google's apps and services. Google is also patching the certification process that allowed this to slip through in the first place.

That said, Android is open source. Videostrong could resurface under different branding, selling boxes without Google apps. It would need to rebuild its malware operation from the ground up, which is not trivial, but it is not impossible either. The certification system failed once. Whether the revised process holds up is a question worth revisiting.