‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm

June 18, 2026 · Krebs on Security · Severity: MEDIUM

For the past four years, a sprawling Android-based botnet called Popa has forced millions of consumer TV boxes to relay Internet traffic linked to advertising fraud, account takeovers, and mass data-scraping efforts.

Key Takeaways

For the past four years, a sprawling Android-based botnet called Popa has forced millions of consumer TV boxes to relay Internet traffic linked to adv. This week, researchers from multiple security firms concluded that the Popa botnet is linked to NetNut, a residential proxy provider operated by the.
Malicious streaming devices sold online that enroll the users home Internet address in a residential proxy service.