A joint operation involving Google disrupted NetNut, a residential proxy network that provided access to approximately 2 million compromised Android devices, including smart TVs and streaming boxes. The takedown targeted the infrastructure enabling unauthorized proxy services, though specific dates of the disruption were not disclosed. No CVE IDs or technical attack vectors were mentioned in the reported details. The impact included cutting off the proxy network’s control over infected devices, reducing potential misuse for malicious activities such as fraud or botnet operations. The operation focused on dismantling the proxy service rather than addressing individual device infections.

Google’s Threat Intelligence Group (GTIG), in collaboration with the FBI and Lumen, disrupted NetNut, a residential proxy network that hijacked approximately 2 million home devices to relay third-party traffic. The operation, announced this week, significantly reduced the network’s pool of usable devices. NetNut, also tracked under the alias Popa, was identified as a large-scale proxy service leveraging compromised residential infrastructure. No specific dates, technical attack vectors, or CVE IDs were disclosed in the report. The disruption targeted the network’s operational capacity but did not detail broader impacts on affected device owners.

The FBI seized domains linked to NetNut, an Israeli residential proxy service, following a joint disruption effort with Google targeting its proxy network. The operation exposed the abuse of approximately 2 million compromised TVs and streaming devices worldwide, which were repurposed as proxies without user consent. NetNut’s infrastructure was allegedly used for cybercriminal activities, though specific attack vectors or threat actors were not detailed. No exact dates for the seizure or disruption were provided in the report. The action highlights the exploitation of consumer devices in large-scale proxy networks.

The Google Threat Intelligence Group (GTIG), in coordination with the FBI and industry partners, dismantled NetNut (also known as Popa), identified as one of the largest malicious residential proxy networks globally. The operation targeted the infrastructure of this proxy network, though no specific technical details, dates, or victim counts were disclosed. NetNut functioned as a proxy service, but its malicious nature was confirmed through the joint takedown effort. No additional impacts, such as data breaches or financial losses, were explicitly mentioned in the report.

En coordinación con el FBI, Lumen y otras organizaciones, Google anunció que empezó a tomar medidas contra la red de proxies residenciales NetNut, también conocida como Popa. Esta…

NetNut's takedown exposed a structural sourcing problem in residential proxies, and why owned infrastructure is what actually matters.

Google et le FBI ont dégradé NetNut, réseau de 2 millions d'appareils domestiques loués comme proxies à des cybercriminels et groupes d'espionnage.

A large-scale residential proxy network called Netnut (also known as Papa) has infected between 1 and 2 million smart TVs, streaming boxes, and cheap routers, hijacking users' internet connections without explicit consent. The network, linked to publicly traded company Alarium Technologies, enables threat actors to route malicious traffic—including Mirai botnet variants, Badbox 2.0, and password spray attacks—through compromised devices, masking their origin. Google’s threat intelligence group reported 316 separate threat groups using Netnut in a single week, while researchers found no evidence of user consent in over 20 apps distributing the malware. Google disrupted the operation by shutting down Netnut’s command-and-control servers and enabling Play Protect to block infected apps, significantly degrading the network. Separately, Cloudflare introduced a monetization gateway in July 2026, allowing websites to charge AI crawlers via cryptocurrency using HTTP 402 status codes, though this risks blocking legitimate search engine indexing. A new macOS infostealer, Pam Stealer, disguises itself as the clipboard manager Maccy, while Rustock malware targets routers, IP cameras, and Android devices for DDoS attacks. The U.S. government is offering a $10 million reward for information on a Russian state-linked cyber group that compromised Signal and WhatsApp accounts of journalists and officials. A 19-year-old Scattered Spider member, Peter Stokes, was extradited to the U.S. in April 2025 for hacking high-profile companies, including MGM and Caesars.

Google, FBI, Lumen e Shadowserver realizaram uma operação conjunta para desmantelar a NetNut, uma das maiores redes de proxies residenciais do mundo. A estrutura usava mais de 2 milhões de dispositivos domésticos, principalmente aparelhos de streaming, formando uma botnet usada por criminosos para esconder ataques cibernéticos. Segundo o Google, apenas em uma semana de junho de 2026 foram identificados 316 grupos de cibercrime e espionagem usando a rede para mascarar invasões e realizar ataques de senha em massa. A NetNut também tinha ligação com outras botnets conhecidas, como a Badbox 2.0 e variantes do malware Mirai. As autoridades recomendam recusar ofertas de apps que prometem pagamento por "internet ociosa", já que esse tipo de serviço pode expor a rede doméstica e alimentar o cibercrime