Google Dismantles Massive Botnet Infecting 1.3 Million Android TV Devices

Google has dismantled a massive botnet comprising over 1.3 million Android TV streaming devices, including popular budget models sold in Israel under the MECOOL brand. According to Google's Threat Analysis Group, the operation was orchestrated by the Chinese manufacturer Videostrong Technology, based in Shenzhen. Videostrong produces White label devices and manufactures MECOOL hardware, managing to bypass Google's official certification process through sophisticated evasion techniques.

Sophisticated Evasion and Malware Delivery

Instead of embedding the complete malware payload in the initial firmware scanned by Google, the manufacturer integrated a small component named x.cpe or com.oemservice. This component installed a backdoor only after the device's first boot sequence. Subsequently, the application disabled Google Play Protect, the built-in security mechanism designed to prevent unauthorized installations, thereby silencing system warnings about silent background updates.

Google's investigation revealed that the infected devices were primarily used as residential proxy networks to route suspicious internet traffic alongside various ad-fraud schemes. More critically, the Chinese manufacturer retained full remote access to the compromised units. Operators could execute terminal commands, capture screenshots, log user keystrokes, extract account credentials, establish reverse shells, and map users' home networks. According to Google's analysis of command-and-control servers, these advanced capabilities were actively exploited in the field. Videostrong's business model involved selling network access to third-party partners who loaded their own custom modules onto the devices.

Global Shutdown and Ongoing Risks

In collaboration with Japanese law enforcement and cybersecurity firms including Lumen, HUMAN Security, Plume, Synthient, and TrendAI, Google successfully neutralized the botnet's domains and control servers. Furthermore, Google severed all business ties with Videostrong and revoked its official licensing agreements. While infected MECOOL streaming devices are currently disconnected from the malicious servers, security experts warn that the x.cpe backdoor resides permanently within the firmware. Operating with system-level privileges, the backdoor reinstalls itself upon every system reboot, leaving users with no simple method for complete removal.