Google Disrupts Massive Proxy Network That Hijacked Millions Of Smartphones And PCs

Google has just announced the takedown of one of the world’s largest residential proxy networks that secretly turned everyday devices into the tools that can be used for cybercrime. The Google Threat Intelligence Group (GTIG), in partnership with other security organisations, disrupted the network known as IPIDEA. According to Google, this operation took advantage of the Android smartphone and Windows PCs by routing malicious traffic through home internet connections. It made cyber attacks look like they were coming from the legitimate residential IP addresses.

Instead of the data centres, a residential proxy network routes internet traffic through real consumer devices. Here infected phones and PCs were unknowingly being used as proxies for the criminals. This helped the attackers to hide their identity behind the innocent users when they carry out malicious activities such as:

- Credential stuffing

- Account takeovers

- Content scraping

- Online fraud

It was harder for the security systems to detect any suspicious activities or behaviour because the traffic appeared to come from normal home networks.

ALSO READ: Airtel Rs 699 Infinity Family Postpaid Plan Launched: Benefits, OTT Perks, And Eligibility

Spread Through Malicious Apps and Software

Google said the IPIDEA network spread via:

- Malicious Android apps

- Proxy software on Windows PCs

This was distributed outside the official app stores and through the third-party platforms. It was malicious, and the malware quietly ran in the background, relaying traffic without many obvious signs, such as battery draining or increased data usage. So this made most of the users unaware and allowed it to work under their noses without them knowing that their device had been compromised.

ALSO READ: Samsung Galaxy S26 Series Could Get Google’s Pixel-Exclusive Scam Detection Feature: Report

GTIG and its partners traced the network’s command-and-control servers and worked with:

- Infrastructure providers

- Domain registrars

They shut down servers and domains that controlled infected devices and forwarded proxy traffic. Google also updated its detection systems so similar networks using the same methods can be identified faster in the future.

Google urged mobile platforms, internet service providers, and technology companies to share intelligence and apply stronger safeguards to limit the harm caused by illegal proxy networks.