Android TV Security: Google Kills 1.3 Million Device Botnet

Millions of Android TV owners in Cuyahoga County and across the country may have unknowingly lent their home networks to digital criminal operations. Google’s Threat Intelligence Group confirmed it has shut down x.cpe, a botnet that controlled more than 1.3 million Android TV devices at its peak. These were not generic, uncertified hardware; they were Google-certified boxes that should have passed strict security screening.

The vulnerability stemmed from Shenzhen-based Videostrong Technology, which primarily sold the affected units under the MECOOL brand. Videostrong used obfuscation techniques to evade initial detection. Once the devices were purchased and connected to the internet, a backdoor allowed the company to remotely install a stub application called x.cpe or com.oemservice. This initial package possessed system-level permissions necessary to deploy additional malware modules without user consent.

The architecture of the attack evolved from a single-stage dropper into a modular three-stage platform. The stub application disabled Play Protect, Google’s built-in security feature, preventing the system from flagging the newly installed packages as malicious. This allowed operators to manage the infected devices remotely, running terminal commands, capturing screens, and probing other devices on the same local network. Google reported observing Videostrong execute these actions in real time.

Financial motives drove the operation. The botnet was used to run residential proxies that routed large volumes of suspicious traffic. It also supported modules engaged in ad fraud schemes, where operators likely sold access to the network to third parties. The scale of the network suggests a substantial revenue stream for the perpetrators, leveraging the trust associated with certified hardware.

Google stated that the screening process missed the threat due to the specific obfuscation methods employed by Videostrong. The certification process is designed to catch such threats before devices reach the market, but the post-setup remote installation allowed the malware to bypass these checks. The shutdown of x.cpe removes the active control of the 1.3 million devices, though the initial compromise occurred during the manufacturing and certification phase.