MECOOL
ProductAm I affected?
Checked against NVD affected-version data on our server. Nothing you type is stored.
Security timeline
- Malware reported by Ars Technica (Security)Google dismantles x.cpe botnet that infected 1.3 million Android TV boxes
- Malware reported by Krebs on SecurityGoogle and partners dismantle XCPE botnet of 1.3 million Android TV boxes
Recent news
Google dismantles x.cpe botnet that infected 1.3 million Android TV boxes
Google's Threat Intelligence Group has disrupted the x.cpe botnet, which at its height ran on over 1.3 million Google-certified Android TV devices, mostly sold under the MECOOL brand by Shenzhen-based Videostrong Technology. The botnet evolved from a single-stage dropper into a modular three-stage platform that sold access to third parties, and it used a stub app with system-level permissions to install modules while disabling Play Protect. Google also observed other infected Android-based IoT devices, including telehealth devices, karaoke machines and digital signage.
Google and partners dismantle XCPE botnet of 1.3 million Android TV boxes
Google, working with industry partners, dismantled the XCPE botnet of over 1.3 million Android TV set-top boxes. The malware was loaded by Videostrong Technology Co., a Chinese manufacturer, which sold access to criminal affiliates and enabled residential proxy services that resold infected devices' IP addresses. Google took legal action against the domains and servers used to control the botnet, and says it has fixed the weakness that let the malware load at first boot.