“Free” movies and TV could cost you your privacy, bandwidth, and control of your home network.

We’ve warned about illegal streaming and modded Amazon Fire TV Sticks in the past. Now, researchers have found that certain SuperBox devices and apps could quietly enroll a household connection into a proxy network, allowing third parties to route traffic through it.

An earlier report identified CyberFlix TV, available through SuperBox’s custom app store, as containing Popanet proxy functionality that registers the device with a server controlled by the proxy operator.

Law enforcement agencies have warned that “foreign entities” are using residential proxies to conceal their identities and make their activity appear to come from someone else’s home network.

The FBI defines a residential proxy as follows:

“A residential proxy is an intermediary server between individuals and websites they visit to make their connections appear to originate elsewhere. Legitimate IP addresses assigned by an Internet Service Provider (ISP) to consumers’ Internet of Things (IoT) devices, such as TV streaming devices, digital picture frames, smartphones, tablets, and routers are used to route traffic. Once an internet-connected device is compromised, the device’s IP address can be used by threat actors to mask their online illegal activity, making the consumer appear responsible.”

Residential proxy networks rent out ordinary home IP addresses to customers. That makes their traffic appear as if it originates from a legitimate consumer connection rather than a data center, helping cybercriminals evade IP-based fraud controls and reputation systems.

Besides affecting connectivity, this can mean that a household’s public IP address becomes associated with activity it did not initiate, ranging from credential stuffing and account abuse to attempts to bypass enterprise security controls.

Plume’s more recent research warns that these proxy networks can also function as malware-delivery platforms. In other words, attackers may not only use a compromised streaming box as an exit node. They may use the proxy connection to reach the box itself and install additional malicious software.

The reported SuperBox configuration is especially troubling because it disables or weakens multiple Android safeguards. Researchers found exposed Android Debug Bridge (ADB) access, root-level privileges without authentication, and the removal of protections that would normally restrict untrusted app installation or prompt users to approve risky actions.

Many people assume that placing a streaming device behind a home router prevents outside access. Normally, network address translation and a firewall do make unsolicited inbound connections more difficult. But proxy-enabled devices can maintain an encrypted outbound connection to a remote server, creating a channel that the home router treats as legitimate traffic initiated from inside the network.

How to stay safe

The safest option is not to connect devices or install apps that promise unauthorized access to free movies and TV. You could be bringing a proverbial Trojan horse into your home.

If you own a SuperBox device or have installed CyberFlix TV, disconnect the device from your network. A factory reset may not be enough to make it safe to use again, so you should replace it.

When a device’s business model depends on monetizing your connection, its security choices can put your IP address, bandwidth, privacy, and local network at risk.

Network segmentation can reduce exposure for ordinary Internet of Things (IoT) devices, but it is not a complete answer here. A product that intentionally establishes a persistent proxy channel and offers weak device-level protection should not be trusted on a household network, even on a separate guest network.

From reporting threats to removing them.

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

In a joint operation, Google, the FBI, and other partners have dealt a significant blow to the residential proxy ecosystem by disrupting the NetNut (also tracked as Popa) botnet.

NetNut is a malicious service built on millions of hijacked consumer devices. NetNut marketed itself as a high-quality residential proxy provider, selling access to “real” home IP addresses for web data collection and other benign-sounding use cases.

The FBI’s definition of a residential proxy:

“A residential proxy is an intermediary server between individuals and websites they visit to make their connections appear to originate elsewhere. Legitimate IP addresses assigned by an Internet Service Provider (ISP) to consumers’ Internet of Things (IoT) devices, such as TV streaming devices, digital picture frames, smartphones, tablets, and routers are used to route traffic. Once an internet-connected device is compromised, the device’s IP address can be used by threat actors to mask their online illegal activity, making the consumer appear responsible.”

The most common method used to add devices to the NetNut network was to  trick users into installing “bandwidth sharing” or proxyware apps that promised payouts for “sharing your unused internet” but buried the true risks in fine print or skipped meaningful consent altogether. Less commonly, devices are sold pre-compromised through grey-market supply chains and shipped with malicious firmware or side-loaded apps.

Once enrolled, these devices could be used to relay password-spraying attacks, account takeover attempts, advertising fraud, and even Mirai-variant DDoS attacks.

The disruption focused on three levers: disabling Google accounts used for NetNut’s command-and-control (C2), sharing detailed indicators on NetNut’s SDKs and infrastructure with platforms and law enforcement, and using Google Play Protect to warn users and automatically disable apps that included NetNut code.

Reportedly, this has significantly disrupted the NetNut botnet, reducing the available pool of devices for the proxy operator by millions.

How to stay safe

A typical home user is unlikely to notice that their devices are part of the NetNut botnet, although they may experience slower performance, reduced internet speeds, faster battery drain, and additional wear and tear on affected devices.

After this blow, the botnet’s operators will likely try to rebuild their network by compromising new devices, or another botnet may take its place. So it’s important to stay vigilant. Some basic tips:

• Be extremely wary of apps that pay you for unused bandwidth.
• Stick to official app stores.
• Check VPN and proxy permissions on your devices.
• Favor reputable, Play Protect–certified vendors for connected devices.
• Use an up-to-date, real-time anti-malware solution on devices that are eligible.

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

Download for iOS → Download for Android →