Android TV box malware found in 1.3M devices

Google says more than 1.3 million connected devices worldwide were compromised by malware built into Android TV boxes and other hardware. The case matters because the hidden software was reportedly installed by a manufacturer, and some affected products had passed Google’s security certification, meaning customers could be exposed despite taking ordinary precautions.

Google’s Threat Intelligence Group identified the software as XCPE and linked it with China-based manufacturer Videostrong Technology, which investigators assess deliberately operated the backdoor for financial gain. Criminal affiliates could use infected devices in residential proxy networks, generate fraudulent advertising activity, capture screenshots and keystrokes, collect account information, or install further software remotely. The article says users might see no obvious sign that their device was being used.