The Kimwolf Botnet is Stalking Your Local Network

The Kimwolf botnet, which KrebsOnSecurity reported on January 2, 2026, has infected more than 2 million devices globally, with two-thirds of infections on Android TV boxes that lack security or authentication. The spread relies on turning end users’ connections into residential proxy nodes, then tunnelling back through proxy endpoints into local networks.

Researchers tied much of the activity to IPIDEA’s residential proxy pool, noting that Kimwolf infections surged by exploiting IPIDEA proxy addresses in the previous week. A key factor in the rapid growth is that many of the infected devices ship with Android Debug Bridge enabled by default, allowing remote access and potential malware installation.

The analysis also highlights that digital photo frames and unsanctioned Android TV boxes are prime targets, and that the botnet can be rebuilt quickly by tunnelling through proxy networks. This overview draws on findings published by KrebsOnSecurity, according to KrebsOnSecurity.