Loading story…
LG Electronics is suspending webOS applications that route third-party traffic through residential-proxy technology unless their developers remove the capability. A package-level review by Spur found residential-proxy SDK indicators in 2,058 of 6,038 examined LG webOS and Samsung Tizen applications, with proxy functionality present in more than 42% of the LG apps assessed. The SDKs can turn a television’s internet connection and public IP address into an exit node, potentially with inadequate consent and, in some cases, while the app is closed; weak filtering could also place other devices on the TV’s local network at risk.
The action highlights a broader ecosystem in which developers embed monetization SDKs in consumer software to supply residential IP addresses to proxy providers. Google Threat Intelligence Group disrupted one such network, IPIDEA, after identifying SDKs in more than 600 Android apps and 3,000 Windows binaries that enrolled millions of devices; Google observed over 550 threat groups using its exit nodes during one seven-day period, including China-, North Korea-, Iran-, and Russia-linked actors. Residential proxy nodes may relay credential-stuffing, fraud, account-takeover, scraping, unauthorized-access, or espionage traffic, exposing affected users to blocklisting, service restrictions, and investigative scrutiny.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Google Threat Intelligence Group disrupted IPIDEA, a residential proxy network built through SDKs embedded in more than 600 Android applications and over 3,000 Windows binaries. Google reported that the action removed millions of enrolled devices from circulation; during a seven-day observation window, it identified more than 550 threat groups using IPIDEA exit nodes, including actors linked to China, North Korea, Iran, and Russia.
LG Electronics began suspending webOS applications that route third-party traffic through residential proxy technology and said it was working with developers to remove the functionality. LG had not announced a deadline for developers to comply and may increase scrutiny during its app-review process.
Spur's package-level analysis identified residential-proxy SDK fingerprints in 2,058 of 6,038 examined LG webOS and Samsung Tizen applications, including more than 42% of the examined LG apps. The research found that some SDKs could remain active after an app closed and warned that inadequate filtering could expose devices on a television's local network.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcemalware.news
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers at Spur Intelligence found residential proxy SDKs embedded in **2,058 of 6,038** smart TV applications scanned across **LG webOS** and **Samsung Tizen**, indicating that more than a third of the apps analyzed could route third-party internet traffic through users’ home connections. The apps were often presented as benign utilities or ambient entertainment, including clocks, solitaire, fish tank displays, and puppy-themed apps, while some explicitly offered users a tradeoff between ads and joining a proxy network. Spur said smart TVs are especially attractive as proxy hosts because they are typically always on, rarely monitored like PCs, and can continue proxy activity even after an app is closed.
Jul 28, 2026
Samsung said it is banning Smart TV apps that contain residential proxy software after researchers found several apps could route third-party internet traffic through users’ home connections. Security firm **Mnemonic** reported that some apps passed review with dormant proxy functionality and later fetched remote configuration at launch, allowing the behavior to be activated after approval. Researchers said at least one Samsung-endorsed **Pac-Man** app included **Bright Data** proxy code, raising concerns that large numbers of TVs could be turned into a botnet-like proxy network. The findings highlighted a weakness in Smart TV app review, where thin-shell apps can load remote content that differs from the code originally inspected. Samsung said it has begun removing existing apps containing residential proxy SDKs, blocking new submissions with that functionality, and tightening restrictions after the disclosures. The case also underscored broader risks from third-party SDKs, remote feature toggles, and marketplace trust signals that can give unsafe apps added legitimacy.
Aug 8, 2026
Researchers at Include Security reported that free apps across **Samsung, LG, and Roku** smart TV ecosystems, as well as some mobile apps, embedded a Bright Data SDK that allegedly converts consumer devices into residential proxy exit nodes for web-scraping traffic, including AI data collection. The researchers said the SDK fetches an unauthenticated configuration, opens a persistent WebSocket peer tunnel, and relays third-party HTTP requests through users’ home internet connections, with consent disclosures allegedly buried in hard-to-find interface dialogs. Publicly exposed configuration data indicated a default Wi‑Fi relay cap of **200 GB per device per month**, and partner associations reportedly included **PlayWorks Digital, CloudTV, Viber Media, Moonfrog Labs, and Hola Networks**. The report said smart TVs are especially attractive proxy nodes because they are typically always on, connected to Wi‑Fi, and rarely monitored, while technical design choices reduced visibility by binding traffic directly to physical interfaces and using lower-level iOS networking primitives that can bypass VPN routing and evade common instrumentation. Independent reporting said the main risk is misuse of consumers’ residential IP addresses and bandwidth rather than direct account takeover, and noted that major platforms including **Google, Amazon, and Roku** have restricted background proxy SDK behavior. Include Security said it reverse-engineered the iOS framework, monitored runtime traffic for 30 days, and notified Bright Data on **May 11, 2026**, but had not received a response before publication.
Jun 29, 2026