Loading malware…
Popanet is an Android residential-proxy component embedded in the CyberFlix TV application distributed through the SuperBox custom application store. It silently enrolls affected streaming devices as proxy exits by registering them with operator-controlled infrastructure and relaying third-party traffic through the subscriber’s residential internet connection. This activity can consume substantial bandwidth and causes traffic generated by proxy customers—including automated scraping, account-abuse activity, and enterprise-security bypass attempts—to appear to originate from the victim household. A weakness in Popanet’s local-network access controls has also been demonstrated to permit proxy users to reach internal services on the affected device and potentially pivot into the home network. Popanet has been associated with the SuperProxy residential-proxy network and shares architectural characteristics with related proxy clients used on compromised Android TV devices.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
10 distinct techniques documented for this family, organized by ATT&CK tactic.
The proxy attempts to block access to the subscriber's local network, but contains a bypass that was confirmed through live testing. Remote proxy users can exploit this flaw to reach the device's own internal services, potentially extending the compromise beyond the device to the home network itself.
For each peer server, the SDK opens a TLS connection on port 6000 and speaks a proprietary binary protocol... The message types, recovered from the factory and RTTI symbols: Register, RegisterResponse, Ping, OpenTunnel, TunnelMessage, CloseTunnel, Goodbye. | The SDK contacts lb.gmslb[.]net:443 (TLS) with an HTTP GET that reads like a browser doing its best impression of itself: GET /regdev?usr=<uuid>&userid=<uuid>&dev_ip=<ip>&sdkv=8.0.36&inst=<uuid> HTTP/1.1
Popanet ... silently registers the device with a remote command server and begins relaying foreign internet traffic through the subscriber's home connection.
Cyberflix TV contains hidden proxy software called Popanet that silently registers the device with a remote command server and begins relaying foreign internet traffic through the subscriber's home connection.
Residential proxy networks rent out ordinary home IP addresses to customers. That makes their traffic appear as if it originates from a legitimate consumer connection rather than a data center.
“certain SuperBox devices and apps could quietly enroll a household connection into a proxy network, allowing third parties to route traffic through it.”
The hostnames in peer_servers are rotating front domains. For a single fleet the director returns both sN.viki-play[.]com:6000 and sN.star-layer[.]com:6000 ; the server numbers overlap... The sN identifier and IP are the stable node identity. The domain is disposable.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named only as the subject of the preceding report in this series; no further functional details are provided in this reference.
Proxy functionality that enrolls a streaming device into a residential proxy network, enabling third parties to route traffic through the household's public IP address.
Proxy functionality that can register an installed device with an operator-controlled server, enabling use of a household connection as part of a residential proxy network.
Hidden proxy software embedded in a SuperBox streaming application. It registers compromised devices with a command server and turns them into residential-proxy nodes that relay third-party traffic, including credential and account-takeover material. Its implementation also has a bypass affecting intended local-network access restrictions.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.