Play Protect

Google dismantles x.cpe botnet that infected 1.3 million Android TV boxes

Google◼'s Threat Intelligence Group has disrupted the x.cpe botnet, which at its height ran on over 1.3 million Google-certified Android TV devices, mostly sold under the MECOOL brand by Shenzhen-based Videostrong Technology◼. The botnet evolved from a single-stage dropper into a modular three-stage platform that sold access to third parties, and it used a stub app with system-level permissions to install modules while disabling Play Protect◆. Google also observed other infected Android-based IoT devices, including telehealth devices, karaoke machines and digital signage.