The Popa botnet, an Android-based network averaging 1.5–2.5 million daily IP addresses, has been linked by multiple security researchers to NetNut, a residential proxy service operated by NASDAQ-listed Israeli firm Alarum Technologies. Popa operates as a plugin of the Vo1d botnet, silently turning cheap Android TV boxes and smart TV apps into residential proxy nodes used for advertising fraud, account takeovers, and AI training data scraping. Synthient found outbound Popa traffic clearly routed through NetNut clients, while Alarum denies the botnet characterization. Spur found that over 42% of LG webOS apps and 25% of Samsung Tizen apps include proxy SDKs, and that NetNut's KYC controls are largely ineffective. Security experts warn that these proxy networks are increasingly found inside corporate environments, creating legal and reputational risk for organizations whose IP space is co-opted without their knowledge.
