Kimwolf botnet leverages residential proxies to hijack 2M+ Android devices

The Kimwolf Android botnet has infected an estimated >2 million devices—primarily insecure Android TV boxes and devices in residential proxy pools—by exploiting exposed ADB and insecure proxy SDKs. Operators use the botnet for large-scale DDoS, proxying/reselling bandwidth, and credential-stuffing; the malware employs evasion and resilience techniques (DoT, ECC-signed C2, EtherHiding/ENS domains) and has global reach with heavy concentrations in Vietnam, Brazil, India, and Saudi Arabia. Researchers recommend proxy providers block risky ports, take down C2 infrastructure, and for users to wipe or destroy compromised devices.