[popa-botnet]

June 21, 2026

• Krebs linked the Popa botnet — millions of compromised Android TV boxes relaying traffic for ad fraud, account takeovers, and scraping — to NetNut, a residential-proxy provider run by NASDAQ-listed Israeli firm Alarum Technologies (Krebs on Security). A new Rust-based MaaS, Vektor, is being advertised with a subscriber panel, crypto-drainer, clipper, and CIS-exclusion for ~$120–$450/month (Dark Web Informer). · Threat Intelligence

in FortiBleed Exposes 86,000 FortiGate Devices as North Korea's Sapphire Sleet Poisons the Mastra npm Catalog

June 19, 2026

• Krebs and multiple firms linked the four-year-old Android Popa botnet — millions of consumer TV boxes relaying ad-fraud and account-takeover traffic — to NetNut, a residential proxy provider run by NASDAQ-listed Alarum Technologies (Krebs). · Industry & Policy

in FortiBleed Burns 70,000+ Fortinet Edge Devices While a Leaked GitHub Token Guts Novo Nordisk