Google, in coordination with the FBI and others, has taken action against the NetNut residential proxy network. This action follows a previous disruption of the IPIDEA proxy network and is part of Google's ongoing effort to dismantle malicious residential proxy networks. Google disabled accounts and services used by NetNut for malware command and control. They also shared technical intelligence on NetNut's software development kits and infrastructure with platform providers and researchers. Google Play Protect will now warn users and disable applications incorporating NetNut SDKs, providing ongoing protection. These actions are believed to have significantly degraded NetNut's network operations, reducing the available devices by millions. NetNut operates by distributing SDKs to home devices, which then become part of the proxy network. These devices are used to route traffic, masking malicious activity by attackers. This poses risks to unsuspecting device owners, potentially flagging their legitimate traffic as suspicious. In June 2026, numerous threat clusters were observed using NetNut exit nodes for cybercrime and espionage. Consumers are advised to be cautious of applications offering payment for sharing internet bandwidth. Users should also stick to official app stores, review app permissions, and ensure security protections like Google Play Protect are active.