Google Shuts Down Global Network of 1.3 Million Compromised TV Streamers
Translated & summarized from Ice by baba
Google has disabled a network of over 1.3 million compromised TV streaming devices globally, including MECOOL models sold in Israel, due to a malicious component embedded by manufacturer Videostrong. The component allowed remote control, rerouting of internet traffic, and potential access to account information. Users are advised to check their device model against a published list and disconnect affected devices from the internet, as factory resets may not remove the threat. The manufacturer allegedly bypassed Google's security checks.
The story in 6 lines · by baba
- Google disabled over 1.3 million compromised TV streamers globally, including MECOOL devices.
- The Chinese manufacturer Videostrong allegedly embedded a remote control component in the devices.
- Compromised streamers were used for rerouting internet traffic and advertising fraud.
- Google identified capabilities for screen capture and account information extraction.
- Users should check their device model against a list and disconnect suspected streamers.
- The embedded malicious component may reinstall itself, even after a factory reset.
Google announced it has disabled a global network of over 1.3 million infected television streaming devices, including models from the MECOOL brand sold in Israel. According to Google's findings, the Chinese manufacturer Videostrong embedded a component in these devices that allowed remote control without the owners' knowledge. The operators used the compromised streamers to reroute internet traffic, making external activity appear to originate from the device owner's home connection. Additional components were employed for advertising fraud. Google stated that access to the devices was sold to parties who installed their own software. Beyond internet traffic manipulation, Google identified capabilities for capturing screen activity, remote operation, and extracting account information, which were exploited in some investigated cases. However, Google clarified that not all MECOOL owners were personally monitored or had their living room cameras activated.
To check if a device is affected, users should compare their model name, found in the device settings, with a list published by Synthient researchers, which includes models like KM2PLUS, KM7PLUS, and KM9PRO_MAX. Synthient emphasizes that a model appearing on the list does not confirm a specific device is compromised. If a model is listed or there's a strong suspicion of compromise, users are advised to disconnect the streamer from the internet and contact the seller or importer. Although Google disabled the control servers, the embedded component remains and could reinstall itself even after a factory reset, meaning a reset does not guarantee the problem is solved. As a precaution, users who logged into personal accounts on a suspected device should change their passwords from a different device, check for unusual logins, and update their router and Wi-Fi passwords. This situation follows a June 2025 FBI warning about streamers and home devices sold with malware. A key aspect of this incident is that Videostrong allegedly bypassed Google's security checks for approved devices. No verified number of affected devices in Israel has been released.