Google Says NetNut Proxy Network Used Millions of Home Devices — Here’s the Smart-TV Privacy Lesson

Google Threat Intelligence Group says it took coordinated action against NetNut, also known as Popa, with help from the FBI, Lumen and other partners. Google describes NetNut as one of the largest residential proxy networks and estimates it involved at least 2 million devices around the world.

The concern is not just that another botnet existed. Residential proxy networks route other people's traffic through real home internet connections, making malicious activity look like it came from normal households. BleepingComputer reported that affected devices included Android devices, smart TVs and streaming boxes, and that Google Play Protect was used to warn users and disable infected applications.

Cheap Android TV boxes, sideloaded streaming apps and unofficial app stores can be tempting, especially when people want more content options. The risk is that a device sold as a bargain can also become someone else's traffic relay, ad-fraud node or account-attack platform.

Google said it observed 316 distinct threat clusters using suspected NetNut exit nodes in one week in June 2026, including cybercriminal and espionage groups. That does not mean every Android TV device is infected, but it does show why app source, update status and Play Protect warnings matter.

On Android phones, tablets and certified Android TV devices, check Google Play Protect, remove apps you do not recognise, and avoid apps that offer payment for unused bandwidth or ask to share your internet connection. Be especially cautious with sideloaded APKs, unofficial IPTV tools, and bargain streaming boxes that cannot receive normal security updates.

For any smart TV or streaming box, update firmware, remove unused apps, reboot after cleanup, and consider resetting or replacing devices that show persistent security warnings. If your home IP is suddenly blocked by websites or your ISP flags suspicious traffic, a compromised device on the network is one possible explanation worth investigating.

A VPN can encrypt traffic from your device to the VPN provider, reduce local network snooping, and help when you are travelling or using public Wi-Fi. On some routers or streaming devices, it can also give you a consistent privacy layer for supported apps.

A VPN does not clean malware from a smart TV, make a trojanized app trustworthy, or stop a malicious app from routing traffic if the device itself is compromised. If the box is part of a proxy botnet, the answer is removal, reset, updates and safer app sourcing — not just changing the IP address seen by websites.

NetNut is a good example of why device security and VPN privacy should be treated as separate layers. Use a VPN for connection privacy, but do not use it as an excuse to keep risky apps or unsupported hardware on your network.