Loading today’s stories
Security1 distinct publisher2 min readPublished
Renting out home IP addresses is a business. Researchers say this hardware signs the household up without asking, leaving the connection answerable for whatever the operator's customers choose to do with it.
The Watch · Security desk
security
WhatsApp's billion passkey logins still fall back to a six-digit PIN1 distinct publisher
security
Android's "unverified developer" flow ships, and the burden shifts to whoever builds the APK1 distinct publisher
product
The UK plant that went dark for four days was too small to have to tell anyone1 distinct publisher
security
CISA finally counts the water intrusions: 100-plus exposed systems behind cellular modems2 distinct publishers
Compiled by The WatchSomething wrong?How this is made
A home router makes unsolicited inbound connections difficult, and that is what people are relying on when they put a cheap streaming box on the LAN and stop thinking about it. It does not stop a session the device opens itself. The proxy client dials out to the operator's server and holds an encrypted connection open, so anything arriving on that session reaches the box as traffic the household started [9].
That channel runs in both directions. Plume's research describes these networks as malware-delivery platforms and not only pools of exit nodes, which means the operator's route to the device is also a route for putting more code on it [7]. The reported SuperBox configuration removes most of what would slow that down, with Android Debug Bridge exposed, root privileges available without authentication, and the prompts that normally gate untrusted installs taken out [8]. Malwarebytes puts the local network in scope alongside bandwidth and privacy [14].
The employee-home-network case is an inference from that mechanism rather than a documented intrusion. Malwarebytes lists attempts to bypass enterprise security controls among the activity a household IP can end up carrying, next to credential stuffing and account abuse [6], and the FBI's definition of a residential proxy names TV streaming devices explicitly as ISP-assigned addresses that can be used to make the consumer appear responsible [3]. Law enforcement warnings that "foreign entities" use residential proxies to hide behind other people's connections are why a fraud team reading its own logs cares about which house the packets came from [4]. The report stops there: it gives no count of enrolled devices, no size for the Popanet network, no date for the research, and no named company breached through one of these boxes [13].
The remediation advice indicates how the researchers rate the device. Malwarebytes recommends disconnecting the box and replacing it, rather than a firmware update or a settings change, because a factory reset may not be enough to make it safe to use again [10]. Segmentation, the standard answer for untrustworthy consumer gear, gets qualified in the same direction, useful for ordinary IoT and not sufficient for a product built to hold a proxy channel open, even on a guest network [11]. That is a judgment about the vendor, more than about a bug. The same firm has issued this warning before about illegal streaming apps and modded Amazon Fire TV Sticks [12]. The difference here is distribution: the proxy functionality arrives through the device maker's own app store [2], which makes it a decision someone in the supply chain took rather than a sideloading mistake by the buyer.
Ranked by verification strength, evidence, and original report placement.
Researchers found that certain SuperBox devices and apps could quietly enroll a household connection into a proxy network, allowing third parties to route traffic through it.
An earlier report identified CyberFlix TV, available through SuperBox's custom app store, as containing Popanet proxy functionality that registers the device with a server controlled by the proxy operator.
The FBI defines a residential proxy as an intermediary server that makes connections appear to originate elsewhere, using legitimate ISP-assigned IP addresses on consumer IoT devices such as TV streaming devices, digital picture frames, smartphones, tablets and routers; once a device is compromised its IP can be used to mask illegal activity, making the consumer appear responsible.
Law enforcement agencies have warned that "foreign entities" are using residential proxies to conceal their identities and make their activity appear to come from someone else's home network.
Residential proxy networks rent out ordinary home IP addresses so that traffic appears to originate from a legitimate consumer connection rather than a data centre, helping criminals evade IP-based fraud controls and reputation systems.
A household's public IP address can become associated with activity it did not initiate, ranging from credential stuffing and account abuse to attempts to bypass enterprise security controls.
Distinct publishers with included, body-backed reporting in this cluster.
1 article · September 4, 2026
Follow any of these and your For You feed starts watching them — no settings page required.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
One vendor post relaying research it never names
Every specific in this story runs through a single Malwarebytes post, and its most consequential specifics are borrowed: the Popanet code in CyberFlix TV is credited to 'an earlier report' with no name or link, the two-way malware risk to Plume research that is summarised rather than cited. The findings Malwarebytes appears closest to — open debug bridge, unauthenticated root, stripped install protections — arrive without a device model, firmware build or test date. The FBI definition is quoted verbatim and is genuinely checkable, but it describes the category and not this box.
Not one number in the whole account
There is nothing to measure. Malwarebytes gives no count of enrolled devices, no size for the Popanet network, no share of SuperBox units carrying the weakened build, and no organisation reached through one. Residential proxy markets are demonstrably real — the FBI quote settles that much — but our coverage never establishes how much of that market runs on this hardware, and we won't manufacture a figure for it.
Replace-the-hardware advice on undated findings
The remedy outruns the disclosure. Owners are told to unplug the device, warned that a factory reset may not clean it, instructed to replace the hardware, and told a guest network isn't containment either — a forceful instruction set built on research with no date, no counts and no response from SuberBox. The underlying phenomenon is not invented; law enforcement has described exactly this pattern on streaming boxes. What's inflated is the confidence-to-verifiability ratio, coming from a company whose product download sits at the foot of the page.
Threat advisory with a download button attached
Two incentives are visible without digging. Malwarebytes ends by asking readers to install Malwarebytes, which makes 'replace the hardware, segmentation won't save you' simultaneously defensible advice and effective marketing; the piece also positions itself in a run of the company's earlier warnings about piracy streaming hardware. Leaning on Plume's research and an unnamed prior report keeps the sourcing entirely inside the security industry. Pointed the other way, Malwarebytes names the seller's incentive precisely: hardware that earns by monetizing the buyer's connection has no reason to lock that connection down.
Solid on the category, thin on this device
Split the story in two and the confidence splits with it. That consumer streaming devices are used as residential proxy exit nodes is backed by the FBI's own definition and law-enforcement warnings, and the router-bypass mechanism Malwarebytes describes is standard and unremarkable. That these particular SuperBox builds enroll households depends on one vendor relaying research it does not identify, with no reply from SuperBox and no second outlet in our coverage. A reader can safely act on the general caution while treating the specific accusation as unconfirmed.