Free apps available on Samsung, LG, Roku, and other connected TV (CTV) platforms are quietly enrolling users’ smart televisions into a commercial residential proxy network operated by Bright Data, according to a technical investigation published June 5, 2026, by Include Security researcher Buchodi.
The embedded SDK, embedded inside partner apps under the guise of a “free content” exchange, effectively turns always-on smart TVs into exit nodes for AI web-scraping traffic routed by paying Bright Data customers, all while bypassing conventional security inspection tools.
Bright Data, a data-collection company that markets “150M+ residential IP addresses” sourced through its consent-based SDK, embeds the software inside free apps offered to consumers on CTV platforms.
One representative case documented by The Verge is Petflix, a Roku app whose opt-in dialog reads: “To enjoy Petflix for free with fewer ads, you are allowing Bright Data to occasionally use your device’s free resources and IP address to download public web data from the internet.” What the dialog omits: the SDK’s publicly queryable configuration file sets a default monthly WiFi bandwidth budget of 200 GB, not the “occasional” usage implied in the consent UI.
The configuration endpoint itself is unauthenticated; any researcher can fetch the full partner manifest, idle-detection thresholds, per-country bandwidth tiers, and feature flags simply by supplying an app bundle ID and SDK version string.
Include Security’s analysis explaining why CTV hardware is uniquely attractive to the residential proxy economy. Unlike mobile phones that run on batteries, shift between WiFi and cellular, and are actively monitored by users, smart TVs are permanently plugged in, always connected to high-speed WiFi, and frequently left unattended for hours.
The SDK’s configuration reflects this by setting ignore_screen_on: true and ignore_on_call: true in its idle-detection rules, meaning the device is considered eligible to relay third-party scraping traffic even when a user is actively watching content or on a phone call, as long as CPU usage stays below 70% and memory usage below 90%.
Corporate and family oversight of smart TVs is also described as “virtually none” compared to mobile endpoints covered by MDM or endpoint detection tools.
Bright Data’s unauthenticated partner manifest names several CTV-focused entities. PlayWorks Digital Ltd, which operates 400+ CTV game titles, claims reach across approximately 250 million TV homes via Comcast, Sky, Cox, LG, Samsung, Vizio, and Roku.
CloudTV, another named partner, is integrated across 125+ TV brands and 15+ OEMs. Longvision Media HK (LongTV) serves 5 million OTT users across Hong Kong and Malaysia. Viber Media (Rakuten), with 250–820 million monthly users, also appears in the manifest alongside Korean mobile publisher Supercent and Indian games developer Moonfrog Labs.
The researcher stresses that inclusion in the manifest confirms that integration existed at some point. However, per-app verification is required to confirm shipping builds at the moment.
After fetching its configuration on every app launch, the SDK opens a persistent WebSocket to proxyjs.brdtnet.com:443, which resolves to AWS Global Accelerator IPs. The TLS certificate presented is CN=*.luminatinet.com, the legacy domain of Luminati Networks, Bright Data’s corporate name before its 2018 rebrand, making this hostname a reliable network-level detection pivot for defenders.
The protocol uses plain JSON frames with no message signing, HMAC, client certificate, or device attestation, which the researcher notes is “substantially less secure than typical C2.”
Critically, the SDK employs two independent inspection bypasses. The control plane (config fetch and telemetry pings) uses Apple’s CFHTTPMessage primitives rather than URLSession, defeating common mobile app-sec instrumentation.
The data plane (the actual peer tunnel) uses NWConnection, with requiredInterface bound to the physical WiFi or cellular interface, bypassing any user-configured VPN, as confirmed empirically by the researcher’s transparent TLS interception setup. The combination means defenders relying on either technique alone will observe only half of the SDK’s activity.
| Partner | Scale | CTV Relevance |
|---|---|---|
| PlayWorks Digital Ltd | 400+ CTV titles; ~250M TV homes via Comcast, Sky, Cox, LG, Samsung, Vizio, Roku | High |
| CloudTV | 125+ TV brands, 15+ OEMs | High |
| Longvision Media HK (LongTV) | 5M OTT users across HK & Malaysia | High |
| Viber Media (Rakuten) | 250M–820M monthly users | Medium |
| Supercent (Korea) | #1 Korean mobile publisher by downloads, 2023 | Medium |
| Moonfrog Labs (Stillfront) | ~10M MAU on Teen Patti Gold; acquired for $90M | Medium |
The SDK’s configuration ships explicit per-country bandwidth policies. Devices in Uzbekistan and Oman are permitted to relay down to 1% battery with daily caps of 1 GB and monthly caps of 30 GB, 60 times the worldwide default monthly allowance of 500 MB.
Qatar and UAE devices are throttled below the global default. Include Security recommends three-layered defenses: DNS-blocking proxyjs.brdtnet.com, proxyjs.luminatinet.com, and clientsdk.bright-sdk.com at the router level; TLS SNI filtering for *.brdtnet.com and *.luminatinet.com; and, for managed enterprise fleets, MDM-based binary scanning for the Swift symbols BrdWebSocketFacade and BrdNetwork.DNSResolver inside installed app binaries.
The researcher notified Bright Data via email on May 11, 2026, and received no response before publication.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…