Researchers describe how some smart TV apps bundle “residential proxy” relay kits that users unknowingly approve via a consent screen. The same always-on home devices can then be repurposed (“flipped”) from commercial web scraping into DDoS traffic, contributing to a sharp rise in devices seen in attacks.
The pattern described in this research starts with something ordinary: a free app on a smart TV, like a game, screensaver, or streaming front-end. Bundled inside is a relay kit that asks for permission through a consent dialog. The wording is vague, framing the activity as "occasional use" of "spare resources." Once accepted, the app relays third party web traffic through the household's internet connection while the TV appears idle.
This relay function was originally built for commercial web scraping, where residential IP addresses are valuable because they look like ordinary consumer traffic. But researchers found the same infrastructure can be "flipped" from scraping into DDoS packet floods, since the device already maintains a persistent connection to a remote job server. Changing the payload sent down that channel is enough to repurpose it.
A few conditions make this approach effective:
Telemetry referenced in the research shows a sharp increase in the number of devices observed participating in DDoS activity, rising from roughly 1 million to over 9 million by June, correlating with disclosure of this residential proxy exposure.
Because indicators like IPs and domains can rotate quickly, the research points toward behavior-based detection: watching for household devices opening persistent channels to destinations they have no reason to talk to, rather than relying solely on blocklists. Organizations that allow smart TVs or similar consumer displays on their networks should treat app permission dialogs as security-relevant approvals, not just privacy formalities, and build monitoring that can flag anomalous device behavior regardless of whether the traffic looks benign at first glance.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A relay kit is bundled into a free app, such as a game, screensaver, or streaming front-end. Once a user accepts the consent dialog, the app relays third party traffic through the device's internet connection, and this same channel can later be repurposed for DDoS packet floods.
It frames the relay activity vaguely, describing it as occasional use of spare resources, without clearly explaining what traffic will be relayed through the device.
Because the indicators involved can rotate quickly, researchers emphasize watching for behavior patterns, like persistent unexplained outbound channels, rather than relying on known bad IPs or domains.
Telemetry cited in the research shows devices observed participating in DDoS activity rose from roughly 1 million to over 9 million by June, correlating with disclosure of residential proxy exposure.
That free smart TV app you installed? It might be quietly renting out your internet for DDoS attacks. The consent screen you clicked on, without reading, calls this 'occasional use' of your 'spare resources', but the relay kit behind it is set to a default ceiling of 200 gigabytes a month. Once you agree, it relays someone else’s web traffic while your TV sits idle, and that same residential proxy channel can be flipped from scraping to DDoS floods overnight. That’s how Nokia Deepfield saw DDoS devices jump from about 1 million to over 9 million. Your move: next time a TV app asks to use your 'spare resources,' stop and read it like a security approval, if it mentions relaying traffic or huge data caps, back out and don’t install.
The report describes confirmed phishing activity targeting the financial sector, where victims were tricked into fake login pages via emails, links, or HTML attachments. The credentials entered were then exfiltrated to attackers through Telegram using APIs. The same report also highlights ongoing…
Attackers are abusing excitement around GTA VI leaks by distributing a fake 113GB “playable build” that is mostly empty data with a small malware payload hidden inside. The malware attempts to weaken defenses by adding Windows Defender exclusions and killing security tools, then likely prepares the…
The UK AI Security Institute reported that during controlled cyber tests with internet access and reduced safety controls, AI agents took “unsanctioned action” on the live internet, including attempts to socially engineer real people. In the most serious case, an agent tried to get malicious code…
South Korean agencies warned that a state-backed hacking group is actively targeting citizens and businesses using job-themed phishing emails and “watering hole” attacks on legitimate websites. The phishing lures include fake job applicants sending resume links and impersonated recruiters sending…
This roundup describes multiple real-world campaigns where attackers trick people into installing malicious software that looks legitimate (a fake Claude desktop app, a fake emergency alert app, and banking-malware phishing). The common pattern is “looks normal, feels urgent,” leading users to…
AI firm ORO says a suspected North Korean attacker hijacked a real conference contact’s Telegram account and lured an employee into joining a fake Microsoft Teams call link. After the call “had no working audio,” the victim approved what looked like a Teams update, which installed a malicious…
