millions

For the past four years, a sprawling, shadow-like infrastructure known as "Popa" has quietly co-opted millions of consumer Android-based TV boxes. Rather than launching the headline-grabbing distributed denial-of-service (DDoS) attacks typically associated with botnets, Popa operates with a more subtle, persistent objective: transforming living-room streaming devices into a global relay network for commercial residential proxies….

For the past four years, an expansive and largely invisible infrastructure known as the Popa botnet has quietly co-opted millions of consumer Android-based TV boxes. These devices, often purchased for their ability to stream subscription video content for a one-time fee, are being weaponized to relay massive volumes of internet traffic. Security researchers have now…