Loading story…
Researchers from Gamers Nexus, Level1Techs, and independent teams allege that tested LG OLED televisions—including a retail 2025 G5—conducted local-network device discovery, collected nearby Wi-Fi identifiers, and processed microphone audio while appearing to be in standby. They reported that speech-derived logs and audio could be retained locally while the TV was offline, then uploaded after connectivity returned, reportedly to infrastructure associated with LG Ad Solutions. The investigation also found LG’s Automatic Content Recognition (ACR) operating across inputs, including HDMI, raising privacy concerns for home, healthcare, and corporate deployments.
The researchers further disclosed alleged, unpatched remote-code-execution vulnerabilities in webOS network-facing services to LG and demonstrated a controlled proof of concept, though no CVEs or public fixes were cited and responsible disclosure remains in progress. A successful compromise could turn a TV into an audio-surveillance endpoint and provide an attacker a foothold on the surrounding network. LG had not publicly responded to the specific findings at publication; the allegations conflict with its existing statement that its TVs do not collect, record, or store ambient conversations. Organizations should apply available firmware updates, disable unnecessary privacy and UPnP features, and isolate TVs on an IoT or guest network.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
The researchers reported undisclosed remote-code-execution vulnerabilities in webOS network-facing services to LG while responsible disclosure was ongoing. They demonstrated a controlled compromise of an LG G5 that recorded audio while the display appeared off and exfiltrated it after connectivity returned; no CVEs, public exploit details, or patches were cited.
In July 2026, Gamers Nexus, Level1Techs, and independent researchers published testing of retail LG OLED TVs, including the G5. They alleged default local-network device discovery, nearby Wi-Fi metadata collection, standby-mode microphone capture and on-device transcription, and later upload of data retained while offline; they also reported ACR activity across inputs including HDMI.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
7 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourcemalwarebytes.com
Open sourcethecybersecguru.com
Open sourceyoutube.com
Open sourcenotebookcheck.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed multiple smart TV vulnerabilities affecting **LG webOS** and **Samsung Tizen OS**, showing that consumer televisions can be compromised for deep system access. Bitdefender reported four flaws in LG webOS versions 4 through 7—`CVE-2023-6317`, `CVE-2023-6318`, `CVE-2023-6319`, and `CVE-2023-6320`—that can let attackers bypass authorization, create a privileged account, inject commands, and escalate privileges to **root**. The attack surface was amplified by Internet exposure: the vulnerable LG control service was intended for LAN use, but more than **91,000** devices were reportedly visible via Shodan. LG confirmed the issues after notification and released fixes before public disclosure.
Jun 29, 2026
Researchers at Include Security reported that free apps across **Samsung, LG, and Roku** smart TV ecosystems, as well as some mobile apps, embedded a Bright Data SDK that allegedly converts consumer devices into residential proxy exit nodes for web-scraping traffic, including AI data collection. The researchers said the SDK fetches an unauthenticated configuration, opens a persistent WebSocket peer tunnel, and relays third-party HTTP requests through users’ home internet connections, with consent disclosures allegedly buried in hard-to-find interface dialogs. Publicly exposed configuration data indicated a default Wi‑Fi relay cap of **200 GB per device per month**, and partner associations reportedly included **PlayWorks Digital, CloudTV, Viber Media, Moonfrog Labs, and Hola Networks**. The report said smart TVs are especially attractive proxy nodes because they are typically always on, connected to Wi‑Fi, and rarely monitored, while technical design choices reduced visibility by binding traffic directly to physical interfaces and using lower-level iOS networking primitives that can bypass VPN routing and evade common instrumentation. Independent reporting said the main risk is misuse of consumers’ residential IP addresses and bandwidth rather than direct account takeover, and noted that major platforms including **Google, Amazon, and Roku** have restricted background proxy SDK behavior. Include Security said it reverse-engineered the iOS framework, monitored runtime traffic for 30 days, and notified Bright Data on **May 11, 2026**, but had not received a response before publication.
Jun 29, 2026
Doctor Web reported that the **Android.Vo1d** backdoor infected nearly **1.3 million Android-based TV boxes** across **197 countries**, making it one of the larger botnet-style compromises seen in consumer smart TV hardware. The malware persists by altering multiple startup paths, including `install-recovery.sh`, `daemonsu`, and `debuggerd`, and uses cooperating components named `vo1d` and `wd` to maintain execution, deploy an encrypted daemon, and install attacker-supplied APKs. The highest infection volumes were observed in countries including Brazil, Morocco, Pakistan, Saudi Arabia, Russia, Argentina, Ecuador, Tunisia, Malaysia, Algeria, and Indonesia, while the initial intrusion vector remained unconfirmed. Additional public reporting tied **Vo1d** to an apparent supply-chain compromise in an **AODIN X1BQ** smart projector sold on Amazon, where the malware was allegedly embedded in firmware before purchase and operated silently as a residential proxy node. The disclosure said the device contacted `ota.triplesai[.]com` after boot, received proxy assignment from `sd002.jaguar-distributor.syslogcollector[.]com`, and sent recurring UDP heartbeat traffic to `o.fecebbbk[.]xyz`, with the firmware build date indicating the compromise predated the buyer's receipt of the device. Malware library entries for variants including **Android.Vo1d.1**, **Android.Vo1d.3**, and **Android.Vo1d.5** indicate the threat has multiple tracked forms, reinforcing concerns that Vo1d is spreading both through post-sale compromise and potentially through preinstalled malicious firmware.
Aug 15, 2026