Loading story…
Researchers at Include Security reported that free apps across Samsung, LG, and Roku smart TV ecosystems, as well as some mobile apps, embedded a Bright Data SDK that allegedly converts consumer devices into residential proxy exit nodes for web-scraping traffic, including AI data collection. The researchers said the SDK fetches an unauthenticated configuration, opens a persistent WebSocket peer tunnel, and relays third-party HTTP requests through users’ home internet connections, with consent disclosures allegedly buried in hard-to-find interface dialogs. Publicly exposed configuration data indicated a default Wi‑Fi relay cap of 200 GB per device per month, and partner associations reportedly included PlayWorks Digital, CloudTV, Viber Media, Moonfrog Labs, and Hola Networks.
The report said smart TVs are especially attractive proxy nodes because they are typically always on, connected to Wi‑Fi, and rarely monitored, while technical design choices reduced visibility by binding traffic directly to physical interfaces and using lower-level iOS networking primitives that can bypass VPN routing and evade common instrumentation. Independent reporting said the main risk is misuse of consumers’ residential IP addresses and bandwidth rather than direct account takeover, and noted that major platforms including Google, Amazon, and Roku have restricted background proxy SDK behavior. Include Security said it reverse-engineered the iOS framework, monitored runtime traffic for 30 days, and notified Bright Data on May 11, 2026, but had not received a response before publication.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
On 2026-06-05, Include Security published research alleging that Bright Data's SDK embedded in partner apps can turn mobile devices and smart TVs into residential proxy exit nodes for web-scraping traffic, including AI data collection. The report described technical behaviors including unauthenticated configuration retrieval, persistent peer tunnels, VPN bypass on iOS, and exposed partner associations.
Include Security said it notified Bright Data on 2026-05-11 about its findings on the company's SDK allegedly turning consumer devices into residential proxy exit nodes. The researchers said they had not received a response by the time of publication.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcexakep.ru
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourceblog.includesecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers at Spur Intelligence found residential proxy SDKs embedded in **2,058 of 6,038** smart TV applications scanned across **LG webOS** and **Samsung Tizen**, indicating that more than a third of the apps analyzed could route third-party internet traffic through users’ home connections. The apps were often presented as benign utilities or ambient entertainment, including clocks, solitaire, fish tank displays, and puppy-themed apps, while some explicitly offered users a tradeoff between ads and joining a proxy network. Spur said smart TVs are especially attractive as proxy hosts because they are typically always on, rarely monitored like PCs, and can continue proxy activity even after an app is closed.
Jun 29, 2026
Security researchers reported that residential proxy networks are increasingly being used to route malicious traffic through legitimate home internet connections, helping attackers evade IP reputation controls while making abuse appear to come from ordinary consumers and organizations. Infoblox said more than **65%** of its cloud customers queried domains tied to residential proxy services in 2026, with monthly DNS traffic rising from roughly **300–400 billion** queries in early 2025 to more than **500 billion** by April 2026, affecting every industry vertical examined, including healthcare, pharmaceuticals, banking, government, electronics, food and beverage, and industrial sectors. The company also observed no meaningful drop after disruption efforts against **IPIDEA**, and recorded a **265%** single-day spike in queries to `ipinfo[.]ipidea[.]io` on January 23. Separate telemetry from Gen Digital linked residential proxy traffic to **7.4 million** malicious incidents affecting **572,000** users since January 2026, with notable concentration in India, Vietnam, and Brazil. Researchers said devices are often enrolled through pay-for-bandwidth apps, free VPNs, browser extensions, bundled SDKs, preinstalled Android TV software, IoT devices, malware, and potentially unwanted applications, sometimes without clear user consent. The reports warn that these networks are being used for phishing, credential stuffing, account takeover, ad fraud, scams, scraping, and reconnaissance, while shifting legal, reputational, and performance risks onto households and enterprises whose IP addresses become exit nodes. Recommended mitigations include **Protective DNS**, DNS log reviews, auditing apps and browser extensions for embedded proxy components, inspecting connected devices, and removing unknown or suspicious software.
Jun 29, 2026
Researchers reported that malicious Android applications, including VPN-themed apps and software built with the **LumiApps** SDK, secretly enrolled users’ devices into a proxy network and routed third-party traffic through them without informed consent. HUMAN’s Satori team said the operation, tracked as **PROXYLIB**, used a Golang-based native library, `libgojni.so`, to contact command-and-control servers, register infected phones, and maintain persistent proxy connections through Android services and boot receivers. The activity was linked to earlier infections found in **Oko VPN** and 28 related Google Play apps, as well as a later variant that could be embedded during app development or injected into APKs without source-code access. Investigators said the infrastructure and monetization appeared tied to **Asocks**, a residential proxy service, indicating the compromised devices were likely being sold as proxy exit nodes for cybercriminal use. Google removed the identified apps from Google Play, and **Google Play Protect** now detects or blocks known PROXYLIB-related applications, while researchers warned the operators are likely to keep shifting to third-party app stores and modified APK distribution.
Jun 29, 2026