botnet-infrastructureinternet-exposed-serviceremote-access-implantcommand-and-control-method

SuperBox Streaming Devices Expose Homes to Proxy Abuse and Botnet Infection

Malware Intelligence · 7 sources · Updated 2mo ago · First seen Sep 1, 2026

Researchers reported that certain SuperBox pirate-streaming devices, including the S7 Pro, and the CyberFlix TV application can covertly enroll household connections in the Popanet residential proxy network. Traffic routed through a victim’s public IP address can consume bandwidth, conceal criminal activity, and leave the household associated with abuse it did not perform. Google reportedly estimated that Popanet operated through approximately two million devices.

The affected configurations reportedly disable key Android protections, expose unauthenticated Android Debug Bridge (ADB) access and root privileges, permit silent APK installation, and maintain encrypted outbound proxy connections. In a three-week Popanet honeypot test, researchers logged 1,352 attempts to access ADB services, including attempts to install the Mirai-derived CECbot and the proxy/DDoS-capable Maskify malware. Owners of affected SuperBox devices or devices running CyberFlix TV should disconnect and replace them, as a factory reset may not restore a trustworthy state.

Hunt this familyPull IOCs and campaign context straight into your stack.

Get the IOCs

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · May 28, 2026 – Aug 31, 2026

Reported Aug 31, 20262mo ago
Plume honeypot records attacks on SuperBox ADB services
After joining the Popanet network as a residential exit node and redirecting ADB ports 5555 and 5858 to a honeypot, Plume recorded 1,352 distinct access attempts over more than three weeks. The attempts used 0.0.0.0 or 127.0.0.1 loopback techniques and included efforts to install the CECbot Mirai variant and Maskify.
SuperBox et appareils de streaming pirates : vecteurs de réseaux proxy résidentiels et botnets | CyberVeille
Aug 31, 20262mo ago
Plume details Netway and Proxice abuse on SuperBox devices
Plume Security Labs published Part 2 of its SuperProxy investigation, identifying the Netway SDK in AppLinked and the Proxice framework on SuperBox devices. The report described Netway reverse-proxy infrastructure and a shared proxy credential exposure, plus Proxice's signed DEX payload delivery, ENS-based C2 resolution, private-network access, and apparent credential stuffing against Microsoft login services.
SuperProxy Part 2 : Netway SDK, Proxice et exploitation des proxies résidentiels sur SuperBox | CyberVeille
Aug 31, 20262mo ago
Ars Technica reports Plume findings on SuperBox S7 Pro
Ars Technica published reporting based on Plume research that SuperBox S7 Pro devices expose unauthenticated ADB and root access, disable Android safeguards, and maintain proxy-server connections that can enable remote command execution and malware installation.
SuperBox et appareils de streaming pirates : vecteurs de réseaux proxy résidentiels et botnets | CyberVeille
May 28, 20265mo ago
Plume exposes SuperProxy network in SuperBox streaming devices
Plume Security Labs reported that Cyberflix TV on SuperBox streaming devices contained hidden Popanet software that silently enrolled devices in the SuperProxy residential-proxy network. Researchers observed sensitive credentials, verification codes, enterprise-security bypass attempts, and scraping traffic, and confirmed a flaw that could let proxy users reach internal services and potentially compromise the home network.
Plume Security Labs Exposes Hidden Proxy Network Inside SuperBox Streaming Devices that Route Potentially Harmful Traffic over Home Networks

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Malware

4 linked

Popanet CyberFlix TV Proxice Netway SDK

Organizations

2 linked

SuperboxPopanet

Do you run this?Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.

Hunt This Malware

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

SuperBox Streaming Devices Expose Homes to Proxy Abuse and Botnet Infection

Malware Intelligence · 7 sources · Updated 2mo ago · First seen Sep 1, 2026

Hunt this familyPull IOCs and campaign context straight into your stack.

Get the IOCs

SuperBox Streaming Devices Expose Homes to Proxy Abuse and Botnet Infection

How this story unfolded

Plume honeypot records attacks on SuperBox ADB services

Plume details Netway and Proxice abuse on SuperBox devices

Ars Technica reports Plume findings on SuperBox S7 Pro

Plume exposes SuperProxy network in SuperBox streaming devices

Related entities

Malware

Organizations

See the full picture, correlated to your attack surface.

SuperBox Streaming Devices Expose Homes to Proxy Abuse and Botnet Infection

How this story unfolded

Plume honeypot records attacks on SuperBox ADB services

Plume details Netway and Proxice abuse on SuperBox devices

Ars Technica reports Plume findings on SuperBox S7 Pro

Plume exposes SuperProxy network in SuperBox streaming devices

Related entities

Malware

Organizations

See the full picture, correlated to your attack surface.