# Google disrupts botnet infecting over 1.3 million Android TV devices

- URL: https://talkfuse.com/story/google-dismantles-botnet-secretly-running-on-1-3-million-android-tv-boxes/
- Published: 2026-11-03T17:08:21+00:00
- Updated: 2026-11-03T17:27:49+00:00
- Original publisher: Ars Technica
- Original article: https://arstechnica.com/google/2026/11/google-dismantles-botnet-secretly-running-on-1-3-million-android-tv-boxes/
- Topics: Business, Companies, Elections, Entertainment, Gadgets, Politics, Technology, TV

## Key points

- x.cpe infected more than 1.3 million Android TV devices.
- The malware disabled Play Protect and enabled remote access.
- Google cut off Videostrong and is changing certification checks.

## Summary

Google says it has dismantled x.cpe, a botnet that infected more than 1.3 million Google-certified Android TV devices, mainly boxes sold under the MECOOL brand. The case matters because the malware evaded Google’s certification checks and gave Videostrong Technology, the manufacturer, extensive remote access to devices and their local networks.

After the boxes were set up, a small system-level app contacted the operators, installed malware modules and disabled Play Protect. Google says the devices were used for residential proxy traffic and advertising fraud, and that access was sold to others; Trend Micro counted 1,472,554 infected devices. Google and partners disrupted the network, took legal action against its domains and servers, and barred Videostrong and its subsidiaries from Google services, while updating certification checks. The affected boxes may still have Play Protect disabled and malware modules installed, which users may find difficult to remove.

---
Summarised by TalkFuse (https://talkfuse.com/). Quote the original publisher for the reporting and link this page for the summary and discussion.