Loading story…
Researchers reported that certain SuperBox pirate-streaming devices, including the S7 Pro, and the CyberFlix TV application can covertly enroll household connections in the Popanet residential proxy network. Traffic routed through a victim’s public IP address can consume bandwidth, conceal criminal activity, and leave the household associated with abuse it did not perform. Google reportedly estimated that Popanet operated through approximately two million devices.
The affected configurations reportedly disable key Android protections, expose unauthenticated Android Debug Bridge (ADB) access and root privileges, permit silent APK installation, and maintain encrypted outbound proxy connections. In a three-week Popanet honeypot test, researchers logged 1,352 attempts to access ADB services, including attempts to install the Mirai-derived CECbot and the proxy/DDoS-capable Maskify malware. Owners of affected SuperBox devices or devices running CyberFlix TV should disconnect and replace them, as a factory reset may not restore a trustworthy state.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
Plume Security Labs published Part 2 of its SuperProxy investigation, identifying the Netway SDK in AppLinked and the Proxice framework on SuperBox devices. The report described Netway reverse-proxy infrastructure and a shared proxy credential exposure, plus Proxice's signed DEX payload delivery, ENS-based C2 resolution, private-network access, and apparent credential stuffing against Microsoft login services.
Ars Technica published reporting based on Plume research that SuperBox S7 Pro devices expose unauthenticated ADB and root access, disable Android safeguards, and maintain proxy-server connections that can enable remote command execution and malware installation.
Plume Security Labs reported that Cyberflix TV on SuperBox streaming devices contained hidden Popanet software that silently enrolled devices in the SuperProxy residential-proxy network. Researchers observed sensitive credentials, verification codes, enterprise-security bypass attempts, and scraping traffic, and confirmed a flaw that could let proxy users reach internal services and potentially compromise the home network.
After joining the Popanet network as a residential exit node and redirecting ADB ports 5555 and 5858 to a honeypot, Plume recorded 1,352 distinct access attempts over more than three weeks. The attempts used 0.0.0.0 or 127.0.0.1 loopback techniques and included efforts to install the CECbot Mirai variant and Maskify.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 37 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
7 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcexakep.ru
Open sourcemalware.news
Open sourcemalwarebytes.com
Open sourcecyberveille.ch
Open sourceplume.com
Open sourceprnewswire.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Black Lotus Labs reported a sprawling malicious residential proxy ecosystem built from compromised IoT and SOHO routers, Android devices, and Android TV boxes, tracking nearly **20 million distinct IPs per day** across **30+ botnet clusters**. The research identified major services and botnets including **IPIDEA, Jaguar, Kookeey, NetNut/Popa, G3Proxy, NSOCKS/Ngioweb, and ASOCKS/Nexusnet**, and said many operators both maintain their own botnets and resell access to other infected devices. Lumen said more than 20 of the clusters regularly exceed 100,000 daily victims, with roughly half of the tracked malicious proxy botnets operated by Chinese actors and many services excluding mainland China from their proxy pools. Separate analysis of the low-cost Android-based **Magcubic HY300 Pro+** projector showed how consumer hardware can feed that ecosystem. Investigators found preinstalled firmware components, including **`com.hotack.silentsdk`** and **`com.hotack.writesn`**, generating suspicious DNS requests such as **`usmyip.kkoip.com`** and appearing designed to register the owner’s IP address for possible enrollment into a residential proxy network without consent. Researchers warned the issue may extend to other inexpensive Android projectors tied to **Hotack, Huyukang, and Nonete**, reinforcing concerns that cheap, poorly vetted smart devices are being used as covert infrastructure for proxy botnets and related criminal activity, including card fraud operations and DDoS abuse.
Jul 30, 2026
Researchers and independent analysts linked a large Android supply-chain botnet known as **BADBOX** to preinfected TV boxes, smart TVs, and some smartphones, with malware embedded in firmware or silently installed through privileged system components. Reports described more than **190,000** compromised devices, including low-cost Android TV boxes built on AllWinner and RockChip platforms as well as higher-profile products such as **Yandex 4K QLED TVs** and the **Hisense/Instawall T963**. The malware survives factory resets, contacts command-and-control servers at boot, uploads device identifiers and telemetry, and can fetch secondary payloads used for ad fraud, account abuse, remote code installation, and residential proxying.
Aug 21, 2026
Germany's Federal Office for Information Security (**BSI**) disrupted the **BadBox** malware operation by sinkholing command-and-control DNS traffic from more than **30,000** infected Android-based IoT devices sold in the country. The malware was found preinstalled in device firmware, particularly on internet-connected products such as digital picture frames, media players, and streaming devices, with officials warning that additional categories may also be affected, including smartphones and tablets. BSI said the compromised devices often run outdated Android versions and old firmware, increasing exposure to further botnet activity beyond BadBox. Authorities said **BadBox** can steal data, capture two-factor authentication codes, download additional malware, create email and messaging accounts for disinformation campaigns, commit ad fraud, and turn devices into residential proxies for criminal abuse. Internet service providers are expected to notify affected owners, and BSI advised consumers to disconnect suspected devices and consider returning or discarding them because the firmware itself cannot be trusted. Google said the impacted off-brand products were not **Play Protect-certified** Android devices.
Aug 15, 2026