Google dismantles x.cpe botnet that infected 1.3 million Android TV boxes
- Severity
- High
- Sources
- 2
What happened
Google's Threat Intelligence Group disrupted the x.cpe (X.CPE) botnet, which reached over 1.3 million Google-certified Android TV set-top boxes, mostly MECOOL devices made by Videostrong Technology, and also hit other Android IoT devices such as telehealth units, karaoke machines and digital signage. The malware evolved into a modular three-stage platform sold to third parties; a stub package named x.cpe or com.oemservice held system-level permissions, phoned home after setup, and disabled Play Protect while installing modules via a backdoor. The articles do not cite CVE identifiers or specific fixed versions. Defenders should check Android TV and set-top devices for the com.oemservice package and audit unmanaged IoT Android devices on their networks.
For security analysts · Written by AI from 2 sources · Wrong?
What to do
- Check Android TV boxes on your network for the x.cpe or com.oemservice package, especially MECOOL devices.
- Consider removing or replacing uncertified or unmanaged Android set-top boxes and similar IoT devices.
- Segment IoT and streaming devices away from sensitive internal networks.
Written by AI from the sources, checked against them
Full story timeline · 2 updates
Who reported · 2 outlets
Who and what is in it
Malware
Companies
Products