India, Nov. 3 -- Google has dismantled the command infrastructure of XCPE, a malware operation that enrolled more than 1.3 million Android TV set-top boxes into a botnet. The alarming detail is how the devices were infected: researchers say the backdoor was installed during manufacturing, including on hardware that had passed Google's certification checks.

According to Google's Threat Intelligence Group, the operation was run by Videostrong Technology, a manufacturer supplying Android-based devices. Google has cut ties with the company, barred it and associated businesses from supplying certified Android products, and taken legal action against servers used to control infected hardware.

The XCPE backdoor was built into firmware rather t...