Hajra Naz
Security researchers dropped a report on Monday that’s honestly kind of unsettling. Turns out several popular apps on Samsung smart TVs contain code that hands a stranger’s internet traffic through your own connection. Millions of TVs could be affected. Some of these apps claim install numbers in the hundreds of millions, according to what the developers themselves say.
Here’s the part that stings a little. One of the apps involved wasn’t some sketchy unknown thing buried deep in the app store. It was a basic Pac-Man game. Samsung had actually featured it in the “Editor’s Choice” section, right there on people’s home screens.
What’s Actually Going On Here
The apps in question contain what’s called resproxy code, short for residential proxy. Basically, this software takes an outsider’s web traffic and routes it through an ordinary home or office internet connection — yours, if you’ve got one of these apps installed. Once opened, the app can turn your smart TV into a kind of always-on tunnel. An exit node, in technical terms. And it keeps working even after you close the app.
Norwegian cybersecurity firm Mnemonic did the digging here. Their research paints a pretty messy picture of how low-quality apps end up all over Samsung’s app store, some of them carrying code that quietly taps into a user’s internet connection without much fanfare.
A lot of these apps aren’t really apps at all, not in any meaningful sense. They’re shells. A handful of lines of code, built purely to pull content from some other website — a game hosted elsewhere, say. So when someone reviews the app for the store, they’re only looking at those few lines. Not the actual content being loaded. Not what happens once it’s live.
Harrison Sand, an offensive security consultant at Mnemonic, put it simply: what gets reviewed isn’t necessarily what ends up running.
Samsung’s Response
TechCrunch reached out to Samsung for comment, and the company didn’t dodge it. In an emailed statement, Samsung said it’s banning apps that share user internet connections and will start pulling any app found to have that functionality.
A Samsung spokesperson said the company has already restricted new app registrations that include proxy functionality on its Smart TV platform. They added that strict, platform-wide developer policies are being rolled out now, explicitly banning residential proxy SDKs, and that the company is working to track down and remove every app currently in the store that contains this kind of code.
This isn’t happening in a vacuum, either. Last month, LG made a similar move, saying it would ban proxy software from its own app ecosystem. That came after reporting found roughly 42% of apps on LG’s store had somehow enlisted a smart TV into a proxy network. Not a small number.
Read More: Samsung Launches Galaxy XR: A New Era of AI-Powered Immersive Technology
Inside a Residential Proxy Network
This research also gives a rare, up-close look at how these proxy networks actually function.
Resproxy code isn’t limited to smart TVs, by the way. It shows up in regular phone apps too, and even in things like digital picture frames and Android streaming boxes. Any device with this code installed can end up sharing its internet connection without the owner fully realizing it.
And here’s the thing—anytime a resproxy device connects online, someone out there can pay to use that connection. That’s the business model.
To be fair, resproxies aren’t automatically illegal or malicious. Some people use them to get around censorship, routing traffic through what looks like an ordinary residential home instead of an obvious VPN. AI companies lean on them too, often to scrape data from across the web efficiently when training models.
But cybersecurity firms have flagged a real downside. Resproxies have developed a reputation for helping hackers and spies mask their activity during cyberattacks and data breaches. The traffic just looks like it’s coming from a regular household, not a bad actor overseas, which makes it genuinely hard to trace. On top of that, most of this traffic is encrypted, so even if someone tried to inspect it, there’s not much to see.
How Sand Got In and What He Found
To dig deeper, Sand rooted a Samsung smart TV, giving him access to its internal systems and letting him watch every bit of network traffic moving in and out. That included any app quietly sharing the TV’s connection with someone else.
That’s how he found it. The Pac-Man game was running resproxy code from Bright Data, an Israeli company that operates proxy networks with access to millions of residential connections worldwide. Bright Data also runs a marketplace where it sells access to scraped datasets — data pulled using exactly this kind of network, drawing from enlisted TVs acting as exit nodes to download large volumes of public web data from multiple sources at once, often bypassing anti-scraping protections in the process.
Sand noted that Bright Data’s code loads the moment you open the Pac-Man game, though that alone doesn’t turn the TV into an exit node. The code stays dormant until a user accepts a consent screen. Once accepted, though, it activates and keeps running in the background, quietly, until the app gets deleted.
Read More: Elon Musk Just Took Over Tesla’s $16.5B Samsung Deal Here’s Why
There’s a bigger concern lurking here too. Sand pointed out that beyond user consent, something as small as a code change on a web server could instantly flip hundreds of millions of smart TVs into an active, potentially malicious botnet. All at once.
Looking at the traffic flowing through his own TV, Sand saw signs that much of what was moving over the network involved large-scale scraping—LinkedIn profiles, in particular, along with data collection likely meant for AI training. And he was only seeing a small slice of what actually moves through Bright Data’s network as a whole.
