At the heart of the NetNut residential proxy service was the Popa botnet, an engineered stealth communications layer. By embedding deceptive software development kits into inexpensive, off-brand Android-based smart TVs, streaming media boxes and unofficial apps like the SmartTube client, NetNut hijacked ordinary home electronics.

When consumers plugged in these devices, their home internet connections were quietly rented out as residential proxy exit nodes. This allowed malicious traffic to route through legitimate domestic IP addresses, effectively bypassing standard data center blocks and security filters.

AFAIK the only thing illegal about this is they didn't bother with TOS agreements.