⚡ Weekly Recap: Proxy Botnets, Browser Ransomware, AI Agent Tricks, Fake PoC Malware and More

Summary: Google, working with the FBI, Lumen and other partners, took action against the NetNut residential proxy network, also known as Popa, disabling Google accounts and services used for malware command-and-control and updating Google Play Protect to block apps carrying NetNut SDKs. Google estimated the network at no fewer than 2 million devices globally, populated through SDKs shipped on smart TVs and streaming boxes, including botnet plugin components tied to BADBOX 2.0.
Bottom line: Two million home devices were conscripted as routing cover so attackers could mask their activity, and the malware arrived pre-installed before purchase or through apps users downloaded themselves - a supply chain your endpoint controls never see.

Read the original at The Hacker News ↗

Topics: Malware
Mentions: CVE-2025-15660 CVE-2025-66273 CVE-2025-66279 CVE-2026-11310 CVE-2026-11999 CVE-2026-12044 CVE-2026-12050 CVE-2026-12166 CVE-2026-12167 CVE-2026-12168 CVE-2026-13079 CVE-2026-13136 CVE-2026-13774 CVE-2026-13788 CVE-2026-14191 CVE-2026-20191 CVE-2026-20213 CVE-2026-20214 CVE-2026-20215 CVE-2026-20216 CVE-2026-20217 CVE-2026-20243 CVE-2026-20244 CVE-2026-20896 CVE-2026-22678 CVE-2026-22893 CVE-2026-28701 CVE-2026-31928 CVE-2026-3199 CVE-2026-33560 CVE-2026-41120 CVE-2026-41492 CVE-2026-42210 CVE-2026-44024 CVE-2026-44025 CVE-2026-45504 CVE-2026-46242 CVE-2026-48276 CVE-2026-48277 CVE-2026-48281 CVE-2026-48282 CVE-2026-48283 CVE-2026-48286 CVE-2026-48313 CVE-2026-48315 CVE-2026-48316 CVE-2026-48519 CVE-2026-48520 CVE-2026-48611 CVE-2026-49102 CVE-2026-49103 CVE-2026-49877 CVE-2026-50242 CVE-2026-50548 CVE-2026-50549 CVE-2026-53917 CVE-2026-54475 CVE-2026-55047 CVE-2026-55956 CVE-2026-55957 CVE-2026-55958 CVE-2026-55960 CVE-2026-55961 CVE-2026-56022 CVE-2026-56141 CVE-2026-56142 CVE-2026-6679 CVE-2026-6682 CVE-2026-6687 CVE-2026-6688 CVE-2026-7524 CVE-2026-7528 CVE-2026-8037
Related: Adobe Patches 7 CVSS 10.0 Flaws in Cold Fusion and Campaign Classic Cyber Risks ·
⚡ Weekly Recap: Linux Kernel Flaws, AI Malware Tricks, Turla Backdoor, Infostealers and More Cyber Risks ·
Critical Cursor Flaws Could Let Prompt Injection Escape Sandbox and Run Commands Cyber Risks ·