Your smart TV may have been routing espionage traffic through your home network for years. On July 2, 2026, the FBI seized domains belonging to NetNut, a residential proxy service owned by Israeli-listed Alarum Technologies (NASDAQ: ALAR), and Google dismantled the underlying botnet infrastructure powering it. The Popa botnet that fed NetNut had quietly hijacked at least 2 million Android devices worldwide, mostly budget smart TVs and streaming boxes.
In a single week during June 2026, Google Threat Intelligence Group counted 316 distinct threat clusters using suspected NetNut exit nodes. Nation-state espionage groups, ransomware operators, and credential-stuffing gangs all paid to route their traffic through your living room.
What Is NetNut and How Did the Proxy Business Work?
NetNut is a residential proxy service that sold access to IP addresses of real home devices to businesses and threat actors. Legitimate use cases exist: market research, ad verification, scraping around geo-blocks. The problem is that NetNut did not disclose to the device owners that their internet connections were being sold. The devices were compromised, not opted in.
Alarum Technologies, the Israeli company that owns NetNut, is publicly traded on NASDAQ under the ticker ALAR. The company describes NetNut as a “premium residential proxy network.” The FBI describes it differently: a botnet-powered proxy infrastructure used by cybercriminals and foreign intelligence services to hide their location.
Omer Weiss, Alarum’s corporate legal counsel, confirmed the company learned of the FBI domain seizure on July 2, 2026 and stated it would fully cooperate with law enforcement.
How Devices Got Infected: Badbox 2.0 and Trojanized SDKs
Two infection pathways fed the Popa botnet that powered NetNut.
The first was hardware-level. Budget Android TV boxes and streaming sticks from manufacturers in China shipped from the factory with proxy code already installed in firmware. These devices, sold through online…