Google's Threat Intelligence Group has successfully dismantled a large-scale botnet known as x.cpe, which at its peak operated covertly on over 1.3 million Android TV devices. What makes this operation particularly concerning is that the infected hardware consisted of official, Google-certified boxes rather than cheap, unverified knockoffs.

According to Google, advanced obfuscation methods utilized by Shenzhen-based manufacturer Videostrong Technology allowed the malicious code to bypass standard vetting procedures. Most of the affected hardware was sold to consumers under the MECOOL brand.

How the x.cpe Malware Evaded Detection

Google-certified devices must pass rigorous security screening before they are permitted to run Google apps and display official branding. However, Videostrong bypassed these safeguards by deploying a post-activation infection strategy.

Instead of shipping the devices pre-loaded with malicious software, the manufacturer integrated a backdoor that downloaded threats only after the consumer had unboxed and connected the device to the internet. This staged deployment allowed the hardware to clear initial factory checks without raising alarms.

Evolution Into a Modular Multi-Stage Platform

In its published analysis, Google’s Threat Intelligence Group detailed how the x.cpe botnet rapidly transformed from a basic single-stage dropper into a sophisticated, modular three-stage malware platform. Once established, the operators used the infrastructure to sell unauthorized access to third parties.

The infection chain relied on specific operational steps once a device came online:

  • Initial Phone-Home: A stub application identified as x.cpe or com.oemservice connected back to the command servers.
  • Privileged Access: Although the initial stub carried no direct malicious payloads, it possessed critical system-level permissions.
  • Defense Disabling: The stub explicitly disabled Google Play Protect, preventing the built-in security tool from flagging subsequent silently installed packages as malicious.
  • Module Deployment: With defenses neutralized, operators pushed modular payloads to the boxes at their discretion.

Broader Security Implications

The takedown highlights the persistent challenges technology companies face in securing the hardware supply chain, even within ecosystems that maintain strict certification guidelines. While Google has successfully shut down the x.cpe infrastructure, the incident underscores how sophisticated supply-chain obfuscation and delayed malware delivery can undermine factory-level security vetting.