Google shuts down x. Cpe botnet affecting 1.3 million Android TV boxes

Google’s Threat Intelligence Group announced that it has dismantled a large botnet known as x. Cpe. The network operated on more than 1.3 million Android TV devices that had been certified by Google, and it was traced to boxes manufactured by Shenzhen‑based Videostrong Technology. According to the group’s blog post, the malware used obfuscation techniques that allowed it to bypass Google’s certification screening.

The compromised devices, most of which were sold under the MECOOL brand, contained a backdoor that let the attacker install the botnet after the boxes were set up and connected online. A stub application identified as x. Cpe or com. Oemservice phoned home, held system‑level permissions, and could install additional malware modules while disabling Play Protect, which would otherwise flag the packages as malicious. The botnet evolved from a single‑stage dropper into a modular three‑stage platform that offered access to third parties.