Hidden Malware in TV Boxes Poses Major Threat

A widespread malware operation has impacted over 1.3 million streaming devices, primarily Android TV boxes. Investigators with high confidence concluded that a device manufacturer intentionally installed hidden malicious software, creating a backdoor for unauthorized remote access. This operation, identified in a November 2 report, compromised devices that had passed Google's security certification.

The manufacturer, identified as China-based Videostrong Technology, allegedly developed and installed the XCPE malware for financial gain. This software enabled remote operators to access devices, turning them into botnets. Criminal affiliates then used these compromised devices to route internet activity through unsuspecting users' connections and to generate revenue through fake advertising.

This sophisticated malware bypassed Google's security protocols, including Play Protect, and was embedded in the device's firmware. Even a factory reset could not remove the infection, as the system was designed to reinstall it. Google, in collaboration with international authorities, has since dismantled the XCPE botnet and banned Videostrong from producing certified Android devices.

While Google has not provided a comprehensive list of affected products, cybersecurity firm Synthient identified specific models like the MECOOL KM9PRO Max. Users are advised to check their device's brand and model, disconnect suspected devices, secure their home routers, and protect connected accounts. The incident highlights the critical need for manufacturers to ensure hardware integrity and user trust.