Google Shuts Down Botnet on 1.3 Million Android Devices

Google says Videostrong Technology secretly used a backdoor to install malware on more than 1.3 million devices, many of them Android TV boxes, turning them into a botnet. The devices were certified Android products, with many sold under the MECOOL brand, and the malware was installed after they were set up and connected to the internet.

The infected devices were used for ad fraud and to route traffic through residential proxy networks. Google says Videostrong sold access to criminal affiliates, which could add their own malware. The company also observed operators using the devices to run commands, capture screens and examine other devices on local networks. Other affected products included telehealth equipment, karaoke machines and digital signage.

Google says it disrupted the botnet’s command systems and cut ties with Videostrong. The manufacturer is barred from producing or marketing certified Android products or furnishing software intended for those devices. Google estimates that disrupting affiliate systems could also cut off access to at least 10 million other compromised devices. It says it has changed its review process for device manufacturers after finding that obfuscation helped the malware evade screening.