Tag: popa

2 Attack Reports | 0 Vulnerabilities

Attack reports

Popa: From Sourcing to Distribution

An Android proxyware SDK named Popa enrolls consumer devices including phones, tablets, and streaming boxes into a commercial residential proxy network. Operating since at least 2020, Popa and its variants (Loopop, Neupop, and Moneytiser) are distributed inside consumer streaming, IPTV, and utility…
android
proxyware
residential proxy
sdk
popa
2026-06-18
consent bypass
hopanet
loopop
moneytiser
netnut
neupop
Published: June 18, 2026
Downloadable IOCs: 165

IPCola: A Tangled Mess

IPCola, a new proxy service, claims to have millions of active IPs sourced from IoT, Desktop, and Mobile devices. Investigation reveals connections to Gaganode, a decentralized bandwidth monetization service with features resembling a botnet. Gaganode's SDK includes remote code execution capabiliti…
iot
remote code execution
proxy service
2025-12-02
bandwidth monetization
chinese tv boxes
ipcola
instaip
nuochen technology
gaganode
popa
Published: December 2, 2025
Downloadable IOCs: 18
Click here to see more Attack Reports