Google dismantles 1.3M-device botnet run by MECOOL TV box maker Videostrong
Videostrong Technology intentionally deployed malware across Android TV boxes and IoT devices for financial gain, Google says.
What to know
- Videostrong Technology intentionally built and ran a botnet affecting 1.3 million MECOOL TV boxes sold globally, using the devices for screenshot capture, keystroke logging, and data theft.
- The malware exploited a gap in Google's device security review process via obfuscation, allowing installation after initial boot—a vulnerability Google has now closed.
- Affected devices span 10+ countries including the US, UK, Russia, Brazil, and Australia; beyond TV boxes, the malware also infected karaoke machines, telehealth devices, and digital signage.
- MECOOL and Videostrong have not yet publicly responded to the disclosure; users are advised to wipe infected devices.
“These actions include capturing screenshots, injecting key strokes, exfiltrating sensitive information (e.g., account info, package inventories, system logs), and executing shell scripts and commands.”
Google · Android Authority ↗
Google Platform operator, disclosure authorVideostrong Technology Co. MECOOL TV box manufacturerMECOOL TV box brand
How it unfolded 2 developments, newest first · click a bar or a number to jump articles
-
background
Google tightens device review process to close security gap exploited by Videostrong — Google acknowledged that Videostrong had exploited a gap in its device security review process, using obfuscation to load malware after initial boot. The company said it has since made changes to clamp down on the vulnerability.
-
background
Botnet distributed across 10+ countries; infrastructure served multiple IoT device types — Google published a distribution map showing infected devices in Australia, Brazil, Indonesia, Mexico, Russia, South Africa, Spain, Turkey, the UK, and the US. Beyond TV boxes, the malware also infected Android-based karaoke machines, telehealth devices, and digital signage.
-
2
Google details malware capabilities: screenshot capture, keystroke injection, data exfiltration
Google observed Videostrong operators using the infected devices to capture screenshots, inject keystrokes, exfiltrate sensitive information including account credentials and system logs, and execute remote shell commands. The malware used obfuscation techniques to bypass Google's device security tests.
-
1
Google discloses XCPE botnet affecting 1.3 million MECOOL TV boxes
Google and industry partners dismantled a backdoor called XCPE that had turned 1.3 million Android TV boxes into a botnet. The devices were primarily MECOOL brand boxes sold globally on platforms including Amazon and AliExpress.
“We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Co.”
— Google