TL;DR

what: Google, with Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI, took down the control servers of a 1.3 million-device Android botnet and says Shenzhen device maker Videostrong intentionally built the x.cpe backdoor into its boxes.

impact: Operators could silently install apps, run commands, capture screens, steal account details and open reverse shells, and criminal buyers turned the boxes into residential proxies and ad fraud engines across 206 models.

fix: There is no patch: x.cpe lives in firmware signed with the maker's key and reinstalls on reboot, so TrendAI says cleanup needs vendor action, platform protection or device replacement, while Google has banned Videostrong from certified Android.

who: Owners of Videostrong-built and MECOOL-branded Android TV boxes, plus organizations whose remote staff, telehealth, signage or guest networks carry cheap Android hardware.

In late October, more than 1.3 million Android devices, most of them TV set-top boxes…