Google dismantles botnet secretly running on 1.3 million Android TV boxes
Google's Threat Intelligence Group shut down the x.cpe botnet, which infected more than 1.3 million Android TV boxes, including Google-certified devices from Shenzhen-based Videostrong Technology. The malware evolved from a simple dropper into a modular three-stage platform that was sold to third parties. The infection bypassed Google's certification screening by using a backdoor to remotely install malware after devices went online, while disabling Play Protect to avoid detection.
Key points
- Botnet compromised 1.3M+ Google-certified Android TV boxes via obfuscation techniques
- Malware evolved into modular three-stage platform sold to third parties
- Remote installation after certification and Play Protect disabling evaded detection
Summary and key points written by AI from the headline and a short excerpt, so they can be incomplete or wrong. Ars Technica did the reporting; read the original for the full story.
Read the full story at Ars Technica
