‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm

Popa is an Android-based botnet component (distributed via SDKs embedded in pirated streaming apps and TV apps) that turns consumer TV boxes and smart TVs into long-lived residential proxy nodes; researchers from multiple firms link its infrastructure and domains to NetNut/Alarum Technologies. The botnet is used for advertising fraud, account takeovers and large-scale web scraping that has overwhelmed target sites, affects millions of IPs daily, and is actively controlled through rotating domains and relay nodes.