‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm
2026-06-22T19:23:27Z•32891fe64545080521c4be9c955486c28ad28b03b1e5febe768a4c5f4c24d2c0
AI-support-abuse','Kimwolf','DDoS','law-enforcement','hosting-seAWS GovCloudAlarum TechnologiesAndroidCISACanvasGitHub-leakIoTMetaMicrosoftNetNutPatch-TuesdayPopaTV boxesThe Gentlemenaccount-takeoverad-fraudbotnetcredentials-leakdata-extortiondata-scrapingeducation-breachpublic-exploitsransomwareresidential-proxy
What happened
KrebsOnSecurity roundup (May–Jun 2026) highlights multiple high-impact incidents: the Android-based Popa botnet (millions of TV boxes) has been linked to NetNut/Alarum Technologies, fueling ad fraud, account takeovers and mass scraping; a major CISA contractor leak exposed AWS GovCloud keys and internal secrets on GitHub; a data-extortion attack against Canvas threatened data on ~275M students/faculty; Microsoft issued a record Patch Tuesday (nearly 200 fixes, ~36 critical, at least three with public exploit code); Meta’s AI support assistant was abused to hijack Instagram accounts; law-enforc
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- krebs_on_security
- Record identifier
- 32891fe64545080521c4be9c955486c28ad28b03b1e5febe768a4c5f4c24d2c0
- Enrichment time
- 2026-06-22T19:23:27Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.