Buying Cheap Android TVs on Ecommerce Could Drain Your Bank Account
Jakarta, CNBC Indonesia — The United States Federal Bureau of Investigation (FBI), together with Google and several technology companies, has successfully dismantled a giant botnet known as Popa, which hijacked around two million Android TV and smart home devices.
The operation also targeted NetNut, a residential proxy service suspected of being the network’s main infrastructure and linked to an Israeli company.
In the operation carried out on 2 July, the FBI seized a number of domains used by NetNut as part of joint law enforcement action with the US Department of Justice (DOJ) and IRS Criminal Investigation.
In a statement quoted by CNET, the FBI said it had seized several court-authorised domains as part of a coordinated law enforcement operation with the Department of Justice and IRS Criminal Investigation targeting the infrastructure connected to the NetNut residential proxy platform, its administrators, and its users.
US authorities collaborated with Google, Lumen Technologies, and the Shadowserver Foundation in the operation. According to cybersecurity researchers, the network is known as the Popa botnet.
Google revealed that the move dealt a major blow to NetNut’s operations. In an official blog post, the company said the action caused a significant decline in NetNut’s proxy network and business operations, removing millions of devices available to the proxy operator.
NetNut’s official website now displays an FBI seizure notice.
Nevertheless, Google stressed that dismantling NetNut is only a first step. The company explained that residential proxy providers frequently share or sell access to each other’s botnet networks, allowing cybercriminals to switch easily to another provider.
For that reason, Google believes action must be taken against several interconnected infrastructure providers simultaneously for the impact to be truly significant.
How the Popa botnet works
The case began in 2024 when security researchers at XLab discovered Vo1d, a large botnet of Android TV devices, mostly unrecognisable brands, that had been hacked.
The botnet was allegedly used to display fake AI videos featuring Donald Trump and Elon Musk on televisions belonging to the US Department of Housing and Urban Development (HUD).
During the same investigation, researchers also discovered Popa, a network protocol plug-in that is legitimate in itself, used to turn devices into residential proxy nodes with the user’s consent.
However, the version found in the field had been covertly installed on hacked Android TVs without the owners’ knowledge.
The FBI explained that a residential proxy node is an intermediary server that makes a user’s internet connection appear to originate from a different location.
Residential proxy networks are in fact legal in the United States. Many companies use them for security penetration testing, digital advertising verification, marketing data collection, and accessing geo-restricted websites.
However, when the technology is illegally installed on victims’ devices, perpetrators can exploit it to launch various cyberattacks, conduct credential attacks and password spraying, steal sensitive data such as passwords, and even control devices remotely. All such activity appears to come from the victim’s home IP address, concealing the true identity of the perpetrators.
The Israeli connection
In the investigation, Google said NetNut is one of the largest residential proxy network operators in the world.
NetNut is known to be owned by Alarum Technologies, a publicly listed company based in Israel.
On the surface, NetNut operates like a legitimate company, offering proxy services through its official website.
However, late last month, several security researchers confirmed that internet traffic generated by the Popa botnet originated from NetNut users. The finding indicated that NetNut was effectively selling access to the botnet to anyone, for both legitimate and illegal purposes.
That evidence then became the basis for law enforcement to take action against the company’s infrastructure.
Google and security researchers warned that most of the infected devices are cheap, unbranded Android TVs widely sold on global marketplaces such as Amazon, Temu, and AliExpress.
These devices generally run old versions of Android that no longer receive security updates, making them easier to hack.
Researchers also found that a number of cheap TV boxes offering streaming services without subscription fees had been fitted with botnet malware from the factory.
For this reason, Google advises consumers to buy Android TV devices only from trusted manufacturers such as Sony, Nvidia, Google, and other major brands that still regularly receive security updates.