Google Disrupts IPIDEA Proxy Network Hijacking Millions of Devices

Google announced on Wednesday that it has disrupted IPIDEA, a Chinese-operated residential proxy network that hijacked millions of consumer devices worldwide, including at least nine million Android smartphones, to route internet traffic and conceal cybercriminal activities.

The network, described by Google's Threat Intelligence Group as one of the largest of its kind, turned everyday devices such as smartphones, personal computers, and smart home gadgets into exit nodes for proxy services. These proxies allowed users to forward data through residential IP addresses, making malicious traffic appear to originate from ordinary households. While residential proxies have legitimate applications, such as market research and cybersecurity testing, IPIDEA's infrastructure facilitated widespread abuse by threat actors.

Devices became part of the network primarily through software development kits, or SDKs, embedded in more than 600 free Android applications, games, and desktop programs downloaded from various sources. Developers were paid by IPIDEA on a per-download basis to include these SDKs, which were marketed as a way to monetize apps. Once installed, the code enrolled the devices...