MECOOL Android TV: Google Busters TV Box Maker Over Malware Ring

Google has officially severed ties with the company behind MECOOL Android TV boxes following the discovery that the manufacturer allegedly pre-installed malware on its streaming devices.

Key Details of the Botnet Operation - Google and industry partners dismantled the XCPE backdoor, which turned over 1.3 million Android TV boxes into a botnet. - The operation was reportedly run for financial gain by Videostrong Technology Co., an OEM and ODM manufacturer. - Infected devices were exploited for ad fraud, sensitive data exfiltration, and unauthorized system access.

How the Malware Operated According to Google, Videostrong operators actively performed sensitive actions on infected hardware, including capturing screenshots, injecting keystrokes, executing shell commands, and stealing user account details and system logs. The malware wasn't limited to standard TV boxes; it also infiltrated various Android-based IoT products such as karaoke machines, digital signage gadgets, and telehealth devices across multiple global markets including the US, Russia, Brazil, and Australia.

Google's Response and User Recommendations Google admitted that the manufacturer utilized obfuscation techniques to exploit security testing gaps, allowing malware installation after the first boot. The tech giant has since updated its device review processes to prevent similar incidents. Given the severity of the breach, experts strongly advise users to wipe and stop using their MECOOL devices immediately. Safer alternatives such as Google TV Streamer, Walmart Onn, and Xiaomi TV boxes are widely available on the market.