Photo by Glenn Carstens-Peters on Unsplash

The FBI Just Caught Your Cheap Smart TV Box Committing Cybercrimes

Listen, if the attack had come from a massive data center somewhere, I wouldn’t have even blinked.

Just a flurry of rapid-fire password guesses hammering a firewall. In this industry, we call that a “password spray,” and honestly, it happens millions of times a day. You block the hostile server, you take a sip of your coffee, and you move on with your morning.

But this specific traffic didn’t fit the profile.

It wasn’t bouncing off some shady overseas server farm or a known hacker hub. It was coming from a regular, boring residential IP address in a quiet neighborhood.

Don’t have a Medium Premium? [Just click here (friends link) and read it for free.](https://medium.com/techx-official/the-fbi-just-caught-your-cheap-smart-tv-box-committing-cybercrimes-233cef893c4c?sk=cbb4c98c9c8440ec7c5ebe6e4d9d7ff1)

More specifically, it was coming from a smart TV.

Think about it like this: to most people, an IP address is just a random string of numbers. But if you are trying to secure a network, an IP is a passport.

And we are wired to instinctively trust “residential” passports.

When the system sees a home IP, it pictures exactly what you’d expect — a family paying their internet bill, streaming a movie on a Tuesday night, or just scrolling through their phones on the couch.

Because of that assumption, our security filters are deliberately built to let those families pass through without friction.

We lower the drawbridge for them.

Which brings us to the uncomfortable question. What exactly are you supposed to do when the digital call is coming from inside the house?

Botnet is Hiding in Your Living Room

When you realize the call is coming from inside the house, you have to start looking at the houses. And when investigators finally traced this traffic back to its source, what they found sounded like paranoid science fiction.

But I promise you, it wasn’t.

The attacks were real. The IP addresses were real. They were tied to actual, physical devices sitting in over two million living rooms across the globe.

Someone had taken those cheap, off-brand Android TV boxes and streaming media players — the kind you might buy online for thirty bucks to get free channels — and quietly turned them into weapons.

If you took one apart, you wouldn’t see anything physically wrong.

The culprit was buried deep inside the software: a stealthy communications layer known as the Popa botnet. It didn’t sneak in through a sketchy email attachment. It was smuggled in through deceptive software development kits and unofficial apps, like SmartTube, operating right under the promise of free content.

Think about how insidious that is in practice.

A consumer buys this cheap box, plugs it into their TV, connects it to their home Wi-Fi, and sits back to watch a show. They have absolutely no idea that the exact moment they connected, their home internet was quietly rented out to the highest bidder as a “proxy exit node.”

Whenever a cybercriminal wanted to hide their tracks to launch an attack, they didn’t bounce their signal off a dark web server. They routed their malicious traffic right through that unsuspecting living room.

On the screen, the TV was just playing a movie.

But in the background, it was picking digital locks.

Not a Hacker Gang

And that’s the part that really gets under your skin. If you’re imagining a shadowy syndicate of teenagers in hoodies operating out of a dark basement, you’re looking at the wrong threat model.

This wasn’t a back-alley hacking crew. It was a corporate enterprise.

When independent security researchers finally pulled back the curtain, they traced the Popa botnet directly to a massive, highly structured commercial entity called NetNut. And NetNut isn’t some dark web phantom hiding behind layers of encryption. It is owned by Alarum Technologies — a publicly traded Israeli firm listed right on the NASDAQ.

Let that sink in for a second.

This wasn’t a hidden black market operation; it was an business that marketed this massive infrastructure to corporate clients as a “consensual bandwidth-sharing tool.” They even had a slick reseller program, allowing other mainstream proxy brands to white-label their network and sell it under different names.

But that “consent” they talked about? It was a complete illusion.

The millions of people who bought those cheap streaming boxes never saw a terms-of-service warning.

They never checked a box agreeing to let state-sponsored espionage groups use their home router. There was no opt-in. It was simply a glossy corporate veneer layered neatly over a massive, non-consensual botnet.

The Beginning of the End ( How Google, the FBI, and the IRS Joined Forces )

Now, if this had just been one rogue company scraping a few websites to check competitor prices, it would be a weird, skeevy anomaly. You’d read a quick tech blog post about it and move on.

But it wasn’t. The scale was staggering.

Just look at a single week last month — June 2026. In those seven days alone, Google’s Threat Intelligence Group watched as 316 distinct threat clusters ran their traffic through NetNut’s network.

Spies. Cybercriminals. Fraudsters.

All of them quietly using everyday living rooms to run credential stuffing attacks, siphon off ad revenue, and scrape sensitive data.

Shutting an operation like that down isn’t a matter of just blocking a server. It took a massive, unprecedented coalition. You had Google teaming up with the FBI, Lumen Technologies, the Shadowserver Foundation — they even brought in the criminal investigation division of the IRS. And honestly, when the IRS gets involved in your TV streaming box, you know things have seriously escalated.

Google made the first move.

They went into the backend, neutralized the command-and-control accounts, and pushed a silent update through Google Play Protect to automatically kill the compromised apps right on the devices.

Then, the FBI dropped the hammer.

They seized hundreds of domains that held NetNut’s infrastructure together, blinding the network.

Alarum Technologies eventually put out one of those carefully worded PR statements, claiming they would “fully cooperate with law enforcement.”

But the operation was already over. The botnet was crippled, and its pool of millions of hijacked living rooms was finally severed.

The Next Battlefield Is Your Living Room

So, the good guys won this round. But when the dust settles, here is the deeply uncomfortable takeaway from all of this: the traditional security perimeter is gone.

We spend billions of dollars every year building massive enterprise firewalls.

We roll out biometric security and hire teams of analysts to hunt for incredibly complex zero-day exploits. We build digital fortresses to keep the bad guys out.

But what we almost never think about is that cheap, plastic box sitting right under the television.

Google and the FBI managed to catch this one. But the playbook is out there now. And as long as we keep buying unregulated, dirt-cheap mini-computers and plugging them directly into the heart of our home networks, someone is going to find a way to exploit them.

You can lock your front door every night. You can set an impossibly complex Wi-Fi password.

But it’s more than a little unsettling to realize that the biggest security threat in your home isn’t on your laptop or your phone. It might just be the box you bought to watch movies.