Loading story…
Researchers from Synthient, Qurium, Nokia Deepfield, and others said the long-running Popa Android proxyware ecosystem enrolls phones, tablets, streaming devices, and unofficial Android TV boxes into a residential proxy network, and linked parts of that activity to NetNut, a proxy provider owned by Alarum Technologies. The reporting describes Popa as a plugin tied to the Vo1d malware ecosystem that can maintain persistent encrypted tunnels and relay third-party traffic for uses including advertising fraud, account takeovers, mass scraping, and possible access into local networks. Estimates cited by researchers put the network at roughly 1.5 million to 2.5 million daily IPs, indicating years of operation at significant scale.
Synthient said it identified multiple Popa-related variants, including Moneytiser, Loopop, and Neupop, and found that analyzed samples often began proxying traffic as soon as the host app launched. In controlled testing, the firm said some Popa-enrolled devices egressed traffic through NetNut’s commercial proxy gateway, while 18 Android samples communicated directly with sdk.netnut.io and some APKs referenced both sdk.netnut.io and cyberprotector.online; researchers also said none of more than 20 examined publishers invoked an optional consent prompt present in version 2.7.46. NetNut rejected the findings and said it operates a legitimate proxy network with KYC, due-diligence, and misuse-monitoring controls, while broader reporting warned that embedded residential proxy SDKs in consumer apps are increasingly being used for AI-related scraping without meaningful user consent.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Google announced a coordinated disruption of the NetNut residential proxy network, also known as Popa, working with the FBI, Lumen, and other partners. Google said it disabled accounts and services used for command-and-control, shared intelligence on NetNut SDKs and backend infrastructure, and used Google Play Protect to warn users and disable Android apps containing the SDKs.
On 2026-06-18, Nokia Deepfield ERT reported that RoboVPN’s Windows installer bundles the Neunative residential-proxy SDK, which activates when the VPN is idle or disconnected and relays arbitrary third-party traffic through the user’s residential IP. The researchers said the SDK shares backend infrastructure and tunnel protocol elements with the Popa/Vo1d ecosystem and identified weak destination filtering that could expose local ADB on Android-class devices via 0.0.0.0:5555.
In response to the Synthient report, NetNut said it operates a legitimate proxy network with KYC, due diligence, and misuse-monitoring controls and rejected the report’s premises. Separate reporting also noted that NetNut and parent company Alarum denied operating a botnet or controlling the cited infrastructure.
On 2026-06-18, Synthient published research describing Popa as an Android proxyware SDK family embedded in third-party apps and identifying variants including Moneytiser, Loopop, and Neupop. The report said analyzed samples often relayed third-party traffic when host apps launched, observed no use of the optional consent prompt in examined publishers, and found samples communicating with sdk.netnut.io.
Synthient said controlled testing conducted on 2026-06-17 found with high confidence that at least some Popa-enrolled Android devices egressed traffic through NetNut’s commercial proxy gateway. The testing supported the report’s linkage between the Popa proxyware ecosystem and NetNut infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
19 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourceinfosecurity-magazine.com
Open sourcesecurityaffairs.com
Open sourcesecurityweek.com
Open sourcequrium.org
Open sourcesynthient.com
Open sourcecloud.google.com
Open sourceblog.xlab.qianxin.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google said it disrupted **NetNut**—also known as **Popa**—a large residential proxy network that investigators linked to malware delivery, command-and-control activity, and efforts by cybercriminal and espionage actors to mask their origin IP addresses while accessing victim environments. Working with the **FBI**, **Lumen**, and other partners, Google disabled accounts and services allegedly used by the operation, shared technical intelligence on NetNut SDKs and backend infrastructure, and used **Google Play Protect** against apps that incorporated the NetNut SDK. Google estimated the network relied on at least **2 million devices** and said **316 threat clusters** used suspected NetNut exit nodes during a single week in June. The coordinated action also included FBI seizures of NetNut-associated domains, a move that parent company **Alarum Technologies** said disrupted part of the service and could materially affect operations and financial results if the outage persists. Google said the operation significantly degraded the network and cut its available device pool by millions, describing the move as part of a broader campaign against malicious proxy providers after an earlier action against **IPIDEA**. The disruption is being viewed as a blow not only to a botnet-linked service but also to the broader supply of residential proxy infrastructure relied on by multiple threat actors.
Jul 8, 2026
Researchers reported that malicious Android applications, including VPN-themed apps and software built with the **LumiApps** SDK, secretly enrolled users’ devices into a proxy network and routed third-party traffic through them without informed consent. HUMAN’s Satori team said the operation, tracked as **PROXYLIB**, used a Golang-based native library, `libgojni.so`, to contact command-and-control servers, register infected phones, and maintain persistent proxy connections through Android services and boot receivers. The activity was linked to earlier infections found in **Oko VPN** and 28 related Google Play apps, as well as a later variant that could be embedded during app development or injected into APKs without source-code access. Investigators said the infrastructure and monetization appeared tied to **Asocks**, a residential proxy service, indicating the compromised devices were likely being sold as proxy exit nodes for cybercriminal use. Google removed the identified apps from Google Play, and **Google Play Protect** now detects or blocks known PROXYLIB-related applications, while researchers warned the operators are likely to keep shifting to third-party app stores and modified APK distribution.
Jun 29, 2026
Black Lotus Labs reported a sprawling malicious residential proxy ecosystem built from compromised IoT and SOHO routers, Android devices, and Android TV boxes, tracking nearly **20 million distinct IPs per day** across **30+ botnet clusters**. The research identified major services and botnets including **IPIDEA, Jaguar, Kookeey, NetNut/Popa, G3Proxy, NSOCKS/Ngioweb, and ASOCKS/Nexusnet**, and said many operators both maintain their own botnets and resell access to other infected devices. Lumen said more than 20 of the clusters regularly exceed 100,000 daily victims, with roughly half of the tracked malicious proxy botnets operated by Chinese actors and many services excluding mainland China from their proxy pools. Separate analysis of the low-cost Android-based **Magcubic HY300 Pro+** projector showed how consumer hardware can feed that ecosystem. Investigators found preinstalled firmware components, including **`com.hotack.silentsdk`** and **`com.hotack.writesn`**, generating suspicious DNS requests such as **`usmyip.kkoip.com`** and appearing designed to register the owner’s IP address for possible enrollment into a residential proxy network without consent. Researchers warned the issue may extend to other inexpensive Android projectors tied to **Hotack, Huyukang, and Nonete**, reinforcing concerns that cheap, poorly vetted smart devices are being used as covert infrastructure for proxy botnets and related criminal activity, including card fraud operations and DDoS abuse.
Jul 30, 2026