(Some) Google-certified Android TV boxes found to have malware

Google has published a new Threat Intelligence report revealing that 1.3 million certified Android TV boxes were infected with the XCPE backdoor, enrolling them into a botnet used for financial gains. The discovery challenges the assumption that Google certification guarantees security.

Manufacturer implicated

Google assesses with high confidence that the malware was intentionally developed, deployed, and operated by Videostrong Technology, a TV box manufacturer that has been covered in the past for its Android TV products. The company apparently monetized the backdoor by allowing affiliates to load malware modules onto infected devices.

The malware was intentionally developed, deployed, and operated by Videostrong Technology

Malicious activities

The infected devices were used for various malicious activities including running ad-fraud schemes and enrolling the TV boxes in residential proxy networks. These activities generated financial gains for those behind the operation.

Legal response

In response to the security threat, Google has taken legal action to disrupt the botnet operation. The company's report, titled 'Shutting the Door on the XCPE Botnet,' details the extent of the infection and the measures being taken to address the issue.