Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access
Summary: Google took down the command-and-control servers and domains of an Android botnet spanning more than 1.3 million devices, mostly TV set-top boxes, in late October, and said it is highly confident that Shenzhen-based device maker Videostrong intentionally built in a backdoor called x.cpe and sold access to criminals. TrendAI counted 1,472,554 infected devices across 206 models between June 3 and October 1, with Malaysia, Brazil, Iraq, Mexico and Taiwan most affected, and Google expects the action to cut off criminals' access to at least 10 million more infected devices.
What you should know: The backdoor runs as a system app signed with the maker's key inside the firmware, so it reinstalls on restart and cleanup requires vendor action, platform protection or device replacement - meaning the 1.3 million boxes in homes and businesses stay compromised even after the servers are gone. Google has banned Videostrong from building certified Android devices, but as of November 2 the company's own site still advertised "Google Certified Android TV Box" products.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026