The FBI and Google Threat Intelligence Group have carried out a joint operation against a large proxy network that was being used in cybercrime across the world. The infrastructure, which was operated under the name NetNut and tracked by security researchers as the Popa botnet, affected more than 2 million devices. Research linked its spread to low-cost Android-based smart TVs, TV boxes, and a malicious software development kit embedded in unofficial apps such as SmartTube. After connecting to the internet, the infected devices became proxy exit points without clear and meaningful user consent, allowing attackers to route traffic through residential connections and reduce the risk of detection. Google said that in a one-week period in June 2026, at least 316 different threat groups used the infrastructure for password theft, credential theft, ad fraud, and sensitive data collection. Researchers also noted that NetNut was tied to a commercial structure rather than a classic botnet model. Cybersecurity journalist Brian Krebs pointed to links with the Nasdaq-listed Israeli company Alarum Technologies Ltd, while Google did not give a direct assessment of the company. Alarum said it was taking the claims seriously and would fully cooperate with law enforcement. In the operation, authorities seized hundreds of domains, Google disabled accounts used in the command-and-control system, and Play Protect was updated to detect the affected apps and disable apps containing the harmful SDK.
FBI and Google Disrupt Large Proxy Network Used in Cybercrime
A joint operation has significantly disrupted a proxy network that security researchers tracked as the Popa botnet. The infrastructure affected more than 2 million devices and was used for a wide range of cybercrime activity.
More stories to read
technology2 min read10/27/2026Apple offers iPhone Duo replacements as hinge fault comes under scrutiny
Apple has acknowledged early inner-display failures in a small number of iPhone Duos. Its replacement offer follows owner complaints and an iFixit investigation into possible pressure points within the hinge.
technology2 min read10/26/2026Android’s default verification links numbers across Google accounts
Automatic phone number verification extends to all Google accounts on an Android device, including accounts added later. Disabling it does not undo existing links and can affect messaging and account recovery.
ai2 min read10/23/2026AI-assisted PHP discoveries trigger emergency patches and precautionary shutdowns
Two critical PHP vulnerabilities have triggered an international effort to secure websites. Emergency patches followed an early disclosure, while governments and major services temporarily disconnected affected systems.
technology2 min read10/22/2026BETA secures landmark FAA clearance for electric aircraft demonstrations
A new FAA authorisation enables BETA to demonstrate its ALIA A250 to prospective customers, following a safety review. The aircraft completed a 39-mile flight in 20 minutes, although full commercial certification remains outstanding.
technology2 min read10/21/2026Meta’s Petal cable targets petabit capacity across the Atlantic
Scheduled to enter service in 2029, Petal will use dual-core optical fibres and specialised signal amplification to double transoceanic capacity without a proportional rise in power consumption.