Researchers Link Popa Android Proxyware to NetNut Residential Proxy Network

Researchers from Synthient, Qurium, Nokia Deepfield, and others said the long-running Popa Android proxyware ecosystem enrolls phones, tablets, streaming devices, and unofficial Android TV boxes into a residential proxy network, and linked parts of that activity to NetNut, a proxy provider owned by Alarum Technologies. The reporting describes Popa as a plugin tied to the Vo1d malware ecosystem that can maintain persistent encrypted tunnels and relay third-party traffic for uses including advertising fraud, account takeovers, mass scraping, and possible access into local networks. Estimates cited by researchers put the network at roughly 1.5 million to 2.5 million daily IPs, indicating years of operation at significant scale.

Synthient said it identified multiple Popa-related variants, including Moneytiser, Loopop, and Neupop, and found that analyzed samples often began proxying traffic as soon as the host app launched. In controlled testing, the firm said some Popa-enrolled devices egressed traffic through NetNut’s commercial proxy gateway, while 18 Android samples communicated directly with sdk.netnut.io and some APKs referenced both sdk.netnut.io and cyberprotector.online; researchers also said none of more than 20 examined publishers invoked an optional consent prompt present in version 2.7.46. NetNut rejected the findings and said it operates a legitimate proxy network with KYC, due-diligence, and misuse-monitoring controls, while broader reporting warned that embedded residential proxy SDKs in consumer apps are increasingly being used for AI-related scraping without meaningful user consent.