Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access

Google disrupted a botnet composed of over 1.3 million Android devices, primarily TV set-top boxes manufactured by Videostrong, a Shenzhen-based company. The devices were infected with a firmware-level backdoor called x.cpe, which allowed attackers to silently install apps, capture screenshots, steal credentials, and establish reverse shells. Google attributes the backdoor to intentional actions by Videostrong, which sold access to cybercriminals for ad fraud and residential proxy services. The backdoor persists across reboots and cannot be removed by users, requiring device replacement or vendor intervention.

AI-extracted · verify before operational use