Google Dismantles XCPE Botnet of 1.3 Million Android TV Boxes

• •Over 1.3 million Android TV boxes were compromised by a backdoor created by Videostrong.
• •The malware allowed for advertising fraud and hijacking of internet connections.
• •Google has taken legal action against Videostrong and closed the loophole that allowed the infection.

Google has dismantled a botnet of over 1.3 million Android TV boxes, which were compromised by a backdoor embedded by the manufacturer, Videostrong Technology. The malware, known as XCPE, allowed criminals to hijack devices for advertising fraud and other malicious activities. The backdoor bypassed Google’s certification checks, as it was installed after the initial setup. Google has severed ties with Videostrong and taken legal action to dismantle the botnet's control servers. Trend Micro estimates that approximately 1.47 million devices were infected globally, with significant numbers in countries like Malaysia and Brazil. The malware remains difficult to remove as it can reinstall itself from protected system partitions. Google has closed the loophole that allowed the infection and banned Videostrong from producing certified devices. The incident raises concerns about the potential for AI-driven malware to autonomously replicate across devices.