Popa

Google, the FBI, and partners disrupted the NetNut botnet, which used hijacked consumer devices as residential proxies. The operation reduced the botnet's device pool by millions through account disabling, infrastructure sharing, and app warnings. NetNut tricked users into installing malicious apps under the guise of 'bandwidth sharing' payouts.

A botnet named Popa, part of the Vo1d and BADBOX ecosystems, exploits Android-based streaming devices to facilitate ad fraud, account takeovers, and data scraping, with compromised devices routing malicious traffic through home internet connections. The FBI and security researchers warn that these devices, often sold as cheap alternatives for streaming content, can be used for criminal activities without the owner's knowledge.