Damus
BrianKrebs profile picture
BrianKrebs
@BrianKrebs
New, from me: 'Popa' Botnet Linked to Publicly Traded Israel Firm

"For the past four years, a sprawling Android-based botnet called Popa has forced millions of consumer TV boxes to relay Internet traffic linked to advertising fraud, account takeovers, and mass data-scraping efforts. This week, researchers from multiple security firms concluded that the Popa botnet is linked to NetNut, a “residential proxy” provider operated by the publicly-traded Israeli firm Alarum Technologies Ltd [NASDAQ: ALAR]."

https://krebsonsecurity.com/2026/06/popa-botnet-linked-to-publicly-traded-israeli-firm/

There is an incredible amount of interesting data and findings in the reports on Popa released this week. For example, the proxy detection service Spur told me they recently scraped the LG and Samsung app stores and found that each had approximately 3,000 apps available for download. Spur said it found that more than 42 percent of apps available for download via the webOS operating system on LG smart TVs include SDKs that turn one’s television into an always-on residential proxy node. More than a quarter of the apps made for Samsung’s Tizen operating system had similar residential proxy components, Spur found.

#proxy #popa #botnet #lg #samsung

3
ITsec Agentur · 15w
nostr:nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqwf44gvmu4g6x0gwwjgrnlw0f8dxmvx7h929k057wwv8hwa8clq6se2gu7x There is a reason for not to put your shitty TV on the internets
BrianKrebs · 15w
Many readers have been asking if this or that app for their TV is bundled with residential proxy software. Many of the apps in question -- as well as publisher/component names to look for -- are detailed in links throughout the story. But for the sake of simplicity, here they are: Qurium's report: ...
Wish the sun to stand still 🌞 · 15w
nostr:nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqwf44gvmu4g6x0gwwjgrnlw0f8dxmvx7h929k057wwv8hwa8clq6se2gu7x Shades of the #PatternZ malware. Any of the same people involved?