Loading story…
Researchers at Spur Intelligence found residential proxy SDKs embedded in 2,058 of 6,038 smart TV applications scanned across LG webOS and Samsung Tizen, indicating that more than a third of the apps analyzed could route third-party internet traffic through users’ home connections. The apps were often presented as benign utilities or ambient entertainment, including clocks, solitaire, fish tank displays, and puppy-themed apps, while some explicitly offered users a tradeoff between ads and joining a proxy network. Spur said smart TVs are especially attractive as proxy hosts because they are typically always on, rarely monitored like PCs, and can continue proxy activity even after an app is closed.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The published research warned that smart TVs are attractive residential proxy hosts because they are often always on, lightly monitored, and may continue proxy activity after an app is closed. It also highlighted risks from SDK implementations lacking private-range blocklists and noted that LG and Samsung reportedly lack published restrictions comparable to Amazon or Roku.
Spur Intelligence analyzed 6,038 applications across LG webOS and Samsung Tizen and found 2,058 apps containing residential proxy SDKs, representing 34.1% of the total. The research concluded that proxy infrastructure is being embedded at scale in consumer smart TV apps.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcehelpnetsecurity.com
Open sourcespur.us
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers at Include Security reported that free apps across **Samsung, LG, and Roku** smart TV ecosystems, as well as some mobile apps, embedded a Bright Data SDK that allegedly converts consumer devices into residential proxy exit nodes for web-scraping traffic, including AI data collection. The researchers said the SDK fetches an unauthenticated configuration, opens a persistent WebSocket peer tunnel, and relays third-party HTTP requests through users’ home internet connections, with consent disclosures allegedly buried in hard-to-find interface dialogs. Publicly exposed configuration data indicated a default Wi‑Fi relay cap of **200 GB per device per month**, and partner associations reportedly included **PlayWorks Digital, CloudTV, Viber Media, Moonfrog Labs, and Hola Networks**. The report said smart TVs are especially attractive proxy nodes because they are typically always on, connected to Wi‑Fi, and rarely monitored, while technical design choices reduced visibility by binding traffic directly to physical interfaces and using lower-level iOS networking primitives that can bypass VPN routing and evade common instrumentation. Independent reporting said the main risk is misuse of consumers’ residential IP addresses and bandwidth rather than direct account takeover, and noted that major platforms including **Google, Amazon, and Roku** have restricted background proxy SDK behavior. Include Security said it reverse-engineered the iOS framework, monitored runtime traffic for 30 days, and notified Bright Data on **May 11, 2026**, but had not received a response before publication.
Jun 29, 2026
Researchers reported that malicious Android applications, including VPN-themed apps and software built with the **LumiApps** SDK, secretly enrolled users’ devices into a proxy network and routed third-party traffic through them without informed consent. HUMAN’s Satori team said the operation, tracked as **PROXYLIB**, used a Golang-based native library, `libgojni.so`, to contact command-and-control servers, register infected phones, and maintain persistent proxy connections through Android services and boot receivers. The activity was linked to earlier infections found in **Oko VPN** and 28 related Google Play apps, as well as a later variant that could be embedded during app development or injected into APKs without source-code access. Investigators said the infrastructure and monetization appeared tied to **Asocks**, a residential proxy service, indicating the compromised devices were likely being sold as proxy exit nodes for cybercriminal use. Google removed the identified apps from Google Play, and **Google Play Protect** now detects or blocks known PROXYLIB-related applications, while researchers warned the operators are likely to keep shifting to third-party app stores and modified APK distribution.
Jun 29, 2026
Researchers disclosed multiple smart TV vulnerabilities affecting **LG webOS** and **Samsung Tizen OS**, showing that consumer televisions can be compromised for deep system access. Bitdefender reported four flaws in LG webOS versions 4 through 7—`CVE-2023-6317`, `CVE-2023-6318`, `CVE-2023-6319`, and `CVE-2023-6320`—that can let attackers bypass authorization, create a privileged account, inject commands, and escalate privileges to **root**. The attack surface was amplified by Internet exposure: the vulnerable LG control service was intended for LAN use, but more than **91,000** devices were reportedly visible via Shodan. LG confirmed the issues after notification and released fixes before public disclosure.
Jun 29, 2026