NetNut Proxy Shut Down: 2 Million Devices Cut Off

Emily Davis · 2026-07-03

A joint operation involving Google has disrupted NetNut, a residential proxy network that had been secretly hijacking millions of Android devices—including smart TVs, streaming boxes, and phones—to route internet traffic without user consent. This takedown cuts off roughly 2 million infected devices, striking a major blow against a network that enabled anonymity for cybercriminals and shady advertisers. ### What Was NetNut? NetNut was a residential proxy service that paid app developers to embed its SDK into popular applications. Once installed, the SDK turned devices into proxy nodes, routing traffic through them without the owner's knowledge. These devices acted as a massive botnet, giving NetNut clients access to IP addresses that appeared legitimate because they came from real homes and businesses. For a price starting at around $500 per month, customers could route their traffic through these residential IPs, bypassing geo-restrictions, avoiding detection by anti-fraud systems, and covering their tracks. This made NetNut a go-to tool for ad fraud, credential stuffing, and other malicious activities. ### How Google Helped Take It Down Google's security team detected unusual traffic patterns originating from Android devices. They traced the source back to apps containing the NetNut SDK and alerted law enforcement and internet infrastructure providers. The joint operation involved: - **Google Play Protect** flagging apps with the malicious SDK - **Internet service providers (ISPs)** blocking traffic from known NetNut servers - **Law enforcement agencies** coordinating takedowns of command-and-control servers Within weeks, the proxy network was effectively dismantled. Now, those 2 million devices are no longer being used as pawns in someone else's scheme. ### Why This Matters for Privacy and Security This isn't just a win for Google—it's a reminder of how easily your devices can be turned against you. Smart TVs, streaming boxes, and even your phone can become part of a proxy network without you ever knowing. The NetNut case highlights two critical issues: **1. The rise of residential proxy networks** These networks are harder to detect because they use real IP addresses. Unlike data center proxies, which can be easily blocked, residential proxies blend in with normal traffic. That makes them attractive to cybercriminals who want to appear legitimate. **2. The importance of app permissions** Many users grant apps broad permissions without thinking. NetNut's SDK was often hidden inside utility apps like flashlight apps or weather widgets. Always check what permissions an app requests—if it asks for network access when it doesn't need it, that's a red flag. ### What You Can Do to Protect Yourself While the NetNut network is down, others like it are still out there. Here's how to keep your devices safe: - **Only install apps from official stores** like Google Play. Even then, check reviews and developer reputations. - **Review app permissions regularly.** Go into your phone's settings and see which apps have network access. Revoke any that don't need it. - **Use a reliable antivirus or security app** that scans for malicious SDKs. - **Keep your device software up to date** to patch vulnerabilities. ### The Bigger Picture NetNut's takedown is a win, but it's a temporary one. The market for residential proxy services is worth millions, and new players will likely emerge. The real solution is for users to stay vigilant and for platforms like Google to keep cracking down on shady SDKs. Until then, your smart TV could still be a secret agent for someone else. > "Your devices are only as secure as the apps you trust." — Emily Davis Stay safe out there. And maybe think twice before installing that free flashlight app.