Google has taken action against a large-scale malware operation that infected more than 1.3 million certified Android TV boxes, according to the company’s Threat Intelligence Group. The botnet, known as x.cpe, was unusual because it ran on devices that had passed Google’s certification process, which is supposed to prevent malicious software from reaching consumers.
How the malware evaded certification
The devices were manufactured by Shenzhen-based Videostrong Technology and sold largely under the MECOOL brand. Google’s screening failed to catch the threat because Videostrong used obfuscation techniques, the company said. The malware did not ship active on the devices. Instead, a backdoor allowed it to be installed remotely after users had set up their boxes and connected them to the internet.
Once online, a stub application identified as x.cpe or com.oemservice contacted a remote server. That package had no harmful functions of its own but carried system-level permissions that let it install additional modules on command. It also switched off Play Protect, Google’s built-in security feature that would otherwise have flagged the silently installed packages as dangerous.
Over time, the operation grew from a simple dropper into a modular three-stage platform. Access to the infected devices was sold to third parties, turning the botnet into what was likely a profitable business. Most of the boxes were used either to route large volumes of traffic through residential proxies or to carry out ad fraud schemes.
Videostrong retained full control over the devices, which allowed its operators to run terminal commands, capture screens, and probe other devices on the same local network. Google reportedly observed the company carrying out these actions in real time.
Coordinated takedown and legal action
Google worked with Japan’s National Police Agency, Synthient, and Trend Micro to disrupt the network. The company said it has taken legal steps to shut down the domains and servers Videostrong used to operate and install the malware. It also targeted command-and-control servers linked to other malware campaigns. Google estimates that Videostrong has been cut off from roughly 10 million compromised devices.
Trend Micro counted 1,472,554 infected devices, a higher figure than Google’s estimate. The vast majority were located in Brazil, Malaysia, Iraq, Mexico, and Taiwan, though tens of thousands were also active in the United States, Germany, the United Kingdom, Australia, and Canada.
Synthient has published a list of 182 device model names known to be part of the botnet. Anyone who owns a MECOOL box or a white-label Android TV device of uncertain origin should check that list.
What remains on affected devices
The takedown should make the affected devices safer to use, but not fully secure. Play Protect remains disabled, and the inactive malware modules are still installed. Because they are loaded as system apps, users cannot easily remove them.
Google concluded that the operation was not the work of a rogue employee or independent actor, so it has ended its relationship with Videostrong. The company and any subsidiaries are barred from using Google’s Android apps and services. Google also said it is updating its certification process to close the loophole that allowed Videostrong to run its botnet on certified hardware.
Android’s open-source nature means uncertified Android-based TV boxes remain widely available. Videostrong could continue selling malicious hardware under other brand names without Google apps, but it would have to rebuild its malware operation from scratch.
