Threat reportMalwareTL-2026-0858
Popa Botnet — Android TV Box Residential-Proxy Malware (Vo1d/Mzmess Plugin) Linked to NetNut / Alarum Technologies
Popa Botnet — Android TV Box Residential-Proxy Malware (TL-2026-0858), also tracked as Popa, is a high-severity malware campaign, first published 2026-06-18. It is attributed to Vo1d with medium confidence, affects Various OEM Unofficial Android TV boxes (AOSP, maps to 16 MITRE ATT&CK techniques (T1090, T1195, T1204), and is covered by 9 detection rules and 24 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 16MITRE ATT&CK
- Actors
- 2Vo1d
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 24Indicators of compromise
Key facts for TL-2026-0858
- Threat ID
- TL-2026-0858
- Also known as
- Popa, Vo1d Popa plugin, Mzmess Popa
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- Vo1d, Mzmess operators
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- consumer, media, advertising, technology
- Target regions
- Global, South America, Africa, South Asia, Southeast Asia
- Detection rules
- 9
- Indicators of compromise
- 24
Malware and tooling in Popa Botnet — Android TV Box Residential-Proxy Malware
Malware and tooling: Mzmess, Popa, vo1d, RoboVPN
How Popa Botnet — Android TV Box Residential-Proxy Malware works
Popa is a proxy-service plugin of the modular Vo1d/Mzmess Android malware that converts unofficial Android TV boxes and pirated streaming apps into a residential-proxy relay. It registers infected devices, maintains long-lived encrypted connections, and opens on-demand tunnels abused for ad fraud, account takeovers, and mass data-scraping. Reporting links the operation to Israeli residential-proxy provider NetNut and its parent Alarum Technologies Ltd (NASDAQ: ALAR).
Popa is one of four plugins of the modular Android malware family Mzmess, the second-stage payload of the Vo1d botnet (aka LinkDoor). The Mzmess architecture has three components: an 'entry' that downloads the SDK, an 'sdk' that self-updates and downloads plugins (using AES encryption and a shared key, with separate sdkbin, reportcompbin, and pluginbin request channels), and 'plugin' modules that execute business logic. The four observed plugins are Popa (com.app.mz.popan) and Jaguar (com.app.mz.jaguarn) for proxy services, Lxhwdg (com.app.mz.lxhwdgn) for remote access (purpose partly unknown, C2 offline), and Spirit (com.app.mz.spiritn) for ad promotion and traffic inflation.
Popa implements a persistent communications layer that registers a device, maintains long-lived encrypted connections, and opens communication tunnels on demand — effectively enrolling the device into a residential-proxy pool rather than conducting destructive attacks. Infected devices include unofficial Android TV boxes sold under thousands of brand names (e.g. X96 Mini and generic HDMI-stick devices) and pirated/modded streaming apps such as CRICFy, DooFlix, Sprozfy, RTS Tv, Flixoid, CyberFlix, Rapid Streamz, TvMob, and HD/OceanStreams. Researchers also reported proxy SDKs embedded in a large share of LG webOS apps (~42% of ~3,000 apps) and Samsung Tizen apps (~25%), plus mobile VPN, screensaver, and productivity apps. A VPN app named RoboVPN was tied to the Vo1d/Popa ecosystem.
The underlying Vo1d loader chain decrypts a package (ts01) containing install.sh, cv, vo1d, and x.apk, and an ELF variant tracked as s63. The malware masquerades under the package name com.google.android.gms.stable to imitate Google Play Services, and establishes persistence by listening for the BOOT_COMPLETED broadcast so it restarts after reboot. Network communications are protected with RSA (to prevent C2 takeover) and XXTEA-encrypted payloads whose keys are RSA-protected, with a Domain Generation Algorithm (DGA) backing C2 resilience.
The operation runs through an estimated 250-300 controller/Internet addresses directing activity and surfaces 1.5-2.5 million distinct IP addresses daily; researchers monitored 26 of 359+ known relay nodes, each handling roughly 35,000-60,000 simultaneous clients. Reporting (KrebsOnSecurity, Synthient, Qurium) attributes the commercial proxy layer to NetNut, a residential-proxy provider owned by publicly-traded Israeli firm Alarum Technologies Ltd (NASDAQ: ALAR); the control domain ninjatech[.]io was linked to Moishi Kramer, identified as NetNut's VP of Research & Development. NetNut stated the relevant code 'was sold and licensed to third parties including resellers years ago,' while Synthient assessed with high confidence that Popa-infected devices forward traffic from NetNut clients. New Popa control domains were registered following the July 2025 Badbox 2.0 takedown by Google, HUMAN Security, and Trend Micro.
MITRE ATT&CK techniques used in TL-2026-0858
Command and Control
T1090 Proxy; T1573 Encrypted Channel
Initial Access
Execution
defense-evasion
T1406 Obfuscated Files or Information; T1407 Download New Code at Runtime; T1655 Masquerading
command-and-control
T1437 Application Layer Protocol; T1544 Ingress Tool Transfer; T1637 Dynamic Resolution
Impact
T1496 Resource Hijacking; T1657 Financial Theft
Persistence
T1546 Event Triggered Execution
Resource Development
T1583 Acquire Infrastructure; T1584 Compromise Infrastructure; T1587 Develop Capabilities
Affected products and versions in Popa Botnet — Android TV Box Residential-Proxy Malware
- Various OEM — Unofficial Android TV boxes (AOSP, non-Play-Protect-certified)
Vulnerable versions: X96 Mini; generic HDMI-stick TV boxes - Third-party / pirated — Modded streaming apps (CRICFy, DooFlix, Sprozfy, RTS Tv, Flixoid, CyberFlix, Rapid Streamz, TvMob, OceanStreams)
Vulnerable versions: bundled Popa/proxy SDK - LG — webOS apps containing embedded proxy SDKs (reported)
Vulnerable versions: ~42% of ~3,000 surveyed apps - Samsung — Tizen apps containing embedded proxy SDKs (reported)
Vulnerable versions: ~25% of surveyed apps
Remediation for Popa Botnet — Android TV Box Residential-Proxy Malware
Immediate actions
- Block the known Popa control domains (gmslb.net, safernetwork.io, tera-home.com, ninjatech.io) at DNS/perimeter
- Identify and quarantine unofficial Android TV boxes and pirated streaming apps on the network
- Inspect for the masquerade package com.google.android.gms.stable and the Mzmess plugin packages on managed Android devices
Workarounds
- Disable sideloading and unknown-sources installation on Android TV devices
- Replace uncertified Android TV boxes that cannot be remediated
Longer-term hardening
- Restrict procurement to AOSP/Play Protect-certified streaming devices
- Segment IoT/TV devices onto an isolated VLAN with egress filtering
- Deploy DNS monitoring to detect DGA-style C2 beaconing and residential-proxy enrollment traffic
Weaknesses (CWE) in Popa Botnet — Android TV Box Residential-Proxy Malware
Timeline of Popa Botnet — Android TV Box Residential-Proxy Malware
- Vo1d (LinkDoor) Android TV botnet activity tracked; modular Mzmess payload with Popa/Jaguar/Lxhwdg/Spirit plugins identified.
- Vo1d botnet reaches peak of 1,590,299 infected devices across 226 countries/regions.
- India infections surge from 3,901 to 217,771 as the botnet is leased/redistributed regionally.
- XLab/QiAnXin publishes analysis of the new 1.6M-device Vo1d variant detailing Mzmess plugins, RSA/XXTEA encryption, and DGA.
- Google, HUMAN Security, and Trend Micro disrupt the Badbox 2.0 botnet and seize associated domains.
- New Popa control domains registered following the Badbox 2.0 takedown to re-establish C2.
- Qurium investigates mass data-scraping scattered across ~1.4 million addresses tied to the proxy network.
- KrebsOnSecurity and multiple firms release coordinated research linking Popa to NetNut / Alarum Technologies (NASDAQ: ALAR).
Sources cited for Popa Botnet — Android TV Box Residential-Proxy Malware
- Popa Botnet Linked to Publicly Traded Israeli Firm
- Long Live The Vo1d Botnet: New Variant Hits 1.6 Million TV Globally (XLab/QiAnXin)
- Vo1d Botnet's Peak Surpasses 1.59M Infected Android TVs, Spanning 226 Countries (The Hacker News)
- Vo1d Botnet Evolves as It Ensnares 1.6 Million Android TV Boxes (SecurityWeek)
- Current botnet profiles - Vo1d (German BSI)
- Vo1d rising: inside the botnet controlling 1.68M+ Android TVs worldwide (Virus Bulletin VB2025)
- Vo1d Botnet Exposed: How Darktrace Detected a Global Android Threat
Detection coverage for TL-2026-0858
As of 2026-06-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0858 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.