‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm

A sprawling Android-based botnet known as Popa, which has been active for four years, has been linked to NetNut, a residential proxy service operated by the publicly-traded Israeli firm Alarum Technologies Ltd. Researchers have concluded that Popa, which forces millions of consumer TV boxes to relay internet traffic, is used for advertising fraud, account takeovers, and extensive data-scraping operations.

Unlike traditional botnets that engage in destructive activities like distributed denial-of-service attacks, Popa is designed to establish a persistent communication layer. This allows compromised devices to register, maintain encrypted connections, and open communication tunnels on demand. Popa is understood to be a component of the Vo1d botnet, which targets unofficial Android-based TV boxes. These devices are widely available online and often come pre-installed with software that turns the user's TV into a residential proxy, enabling others to route their internet traffic through it.

Initial indicators of Popa's origins emerged in a 2025 report from XLAB, which identified at least nine domain names associated with the botnet's control infrastructure. More recently, security firm Qurium observed these same domains while investigating significant data-scraping events in May 2026 that impacted over 1.4 million internet addresses. Qurium noted that many of the domains used to control Popa were seized or dismantled in July 2025 as part of a disruption of the Badbox 2.0 botnet, which is closely related to Vo1d. Following this disruption, new domains were registered to manage Popa, including one, ninjatech[.]io, which was previously associated with Moishi Kramer.

Kramer, who lists himself as vice president of research and development at NetNut on LinkedIn, stated that his company, Ninjatech, ceased operations approximately five years ago after selling a software development kit (SDK) named Popa. He explained that this SDK was designed to utilize a small portion of a device's bandwidth with user consent. Kramer asserted that once the code was licensed to third parties, his company lost control over its subsequent modification or deployment. He denied that he or NetNut build, operate, or maintain the infrastructure identified as Popa, nor does he control the Ninjatech domain.

However, a separate report from proxy-tracking company Synthient indicated that recent analysis of the Popa SDK revealed outbound traffic directly linked to NetNut. Synthient concluded with high confidence that devices running Popa forward traffic from NetNut clients, suggesting Popa is actively used by NetNut as part of its proxy pool.

Alarum Technologies, NetNut's parent company, disputed the findings, calling the assertions in the reports inaccurate and the deductions flawed. The company stated that the SDKs in question are designed for bandwidth-sharing functionality and do not compromise user devices. Alarum emphasized that NetNut operates a commercial proxy network with policies and measures in place to ensure lawful and responsible use, including customer due diligence and monitoring for misuse.

Despite Alarum's claims, a June 8 report from proxy tracking service Spur asserted that NetNut does not require significant corporate verification or know-your-customer procedures for proxy access. Spur noted that individuals can obtain access and route traffic through partner address space, including that of institutions whose users have not opted in. The report also highlighted that NetNut's services are repackaged by downstream resellers who often perform minimal or no KYC checks, allowing access with basic contact information and cryptocurrency.

Synthient's research also found that while recent versions of the Popa SDK may request user consent for proxy components, many variants and older versions do not. Analysis of over 20 genuine Popa publishers by Synthient did not observe any instances of user consent being requested.

Chris Formosa, senior lead information security engineer for Black Lotus Labs, described Popa as a dangerous botnet due to NetNut's extensive use in reselling and sharing proxy services. He explained that many other proxy services rely on NetNut's infrastructure, leading to Popa's IP addresses appearing across numerous services. Formosa estimated that the Popa botnet utilizes between 1.5 million to 2.5 million distinct IP addresses daily, directed by approximately 250 to 300 internet addresses. This widespread presence, he stated, amplifies its impact and makes it one of the more problematic proxy botnets in the current landscape.