FBI and Google Strike Botnet Network

The FBI and Google Threat Intelligence Group carried out a joint operation against a large proxy network used in cybercrime. The system, known as NetNut and tracked by researchers as the Popa botnet, had reached more than 2 million devices worldwide. It spread through low-cost Android smart TVs, TV boxes, and a malicious software kit found in unofficial apps such as SmartTube. Once the devices connected to the internet, they were used as proxy exit points without clear user consent. This allowed attackers to route traffic through home connections and hide their identity. According to Google, at least 316 different threat groups used the infrastructure during a one-week period in June 2026 for password theft, credential theft, ad fraud, and sensitive data collection. Authorities seized hundreds of domain names, and Google disabled accounts used in the botnet’s command and control system. Google Play Protect was also updated to detect the affected apps.