BotnetPublished 18 Jun 2026

‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm

Source Krebs on Security

Description

The Popa botnet is an Android-based network that has compromised millions of consumer TV boxes over the past four years. It has been used to relay internet traffic for activities such as advertising fraud, account takeovers, and large-scale data scraping. Recent research links the Popa botnet to NetNut, a residential proxy service operated by Alarum Technologies Ltd, a publicly-traded Israeli company. There is no indication of a specific vulnerability or patch available. No known exploits in the wild have been reported.

Impact

The botnet enables unauthorized use of millions of consumer devices to relay internet traffic, facilitating advertising fraud, account takeovers, and mass data scraping. This compromises device owners' privacy and security and enables illicit activities at scale. There is no direct mention of device destruction or data loss, but the misuse of resources and potential privacy violations represent significant impacts.

Defensive guidance

No specific patch or remediation guidance is provided. Since this is a botnet leveraging compromised devices, mitigation would generally involve device owners securing their devices, but no vendor advisory or official fix is mentioned. Monitor updates from device manufacturers or security researchers for potential remediation. The vendor advisory or authoritative source does not provide a fix or mitigation at this time.

Summary

Popa is a large-scale Android botnet that hijacks consumer TV boxes to proxy internet traffic for malicious purposes including advertising fraud and data scraping. Security researchers have connected this botnet to NetNut, a residential proxy provider run by Alarum Technologies Ltd. The botnet has operated for approximately four years, leveraging compromised devices to facilitate various fraudulent and unauthorized activities. The information does not specify a particular vulnerability exploited or a remediation path.

References

krebsonsecurity.com/2026/06/popa-botnet-linked-to-publicly-traded-israeli-firm/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 16 Jul 2026, 15:49 UTC

References

Community reviews

Related threats