Do you have an Android streamer? It may have been spying on you

A Google investigation reveals that the manufacturer of MECOOL set-top boxes planted a backdoor in over a million devices. The malware captured screenshots, collected passwords, and mapped home networks. Google severed the command-and-control servers, but the component remains in the firmware.

A Google cybersecurity investigation has revealed that Chinese manufacturer Videostrong Technology, which produces MECOOL set-top boxes, planted a backdoor in over 1.3 million Android TV devices worldwide, including in Israel. The malware, named XCPE, bypassed Google's certification tests using delay techniques: a small firmware component downloaded and installed the backdoor only after the user booted the device at home. Once activated, the malware disabled Play Protect, captured screenshots, logged keystrokes and passwords, mapped home Wi-Fi networks, and turned the devices into a criminal proxy network. Google cooperated with Japanese police and security companies to disable the command-and-control servers, severed its relationship with Videostrong, and revoked its Android licenses. However, the backdoor component remains burned into the firmware and continues to activate on every boot, with no normal removal option. The article warns against purchasing cheap set-top boxes online.