Your Smart TV Is a Proxy Node: The Botnet Pipeline Nobody Audits
Geert WarmenbolJune 19, 2026
It's June 2028. Your company's legal team receives a subpoena from a plaintiffs' firm representing a consortium of academic publishers. The allegation: your corporate IP ranges were used to scrape millions of copyrighted articles from their repositories. Your first thought is a data breach. But the logs show the traffic originated from inside your network—from a conference room smart TV bought last year, connected to guest Wi-Fi. The TV shipped with a pre-installed streaming app that bundled a residential proxy SDK. That SDK is part of Vo1d's Popa plugin, which routes third-party traffic through your home router—or in this case, your corporate guest network. You are now a node in the AI scraping supply chain. This scenario is not hypothetical. It is the logical endpoint of a trend that began in 2022 with cheap Android TV boxes and gained regulatory velocity by 2026. The only surprise is that most organizations still treat smart TVs as appliances, not networked computers. They are wrong.
Key takeaways
First, residential proxy botnets like Popa are not traditional malware; they are SDKs bundled into legitimate-looking apps, often installed with nominal consent. Second, the primary driver of this ecosystem is not cybercrime in the classical sense—it is the AI industry's insatiable need for scraped training data that eludes datacenter IP blacklists. Third, standard network monitoring tools miss these botnets because the traffic mimics normal residential Internet use. Fourth, the supply chain risk extends beyond no-name streaming boxes to first-party smart TV app stores: Spur's 2026 analysis found over 42% of LG webOS apps contain proxy SDKs. Fifth, prevention requires a multi-layer approach spanning procurement policy, network segmentation, and DNS-layer detection. Finally, the legal landscape is shifting; by 2028, expect strict liability for proxy providers that fail to obtain verifiable end-user consent.
BLIND SPOTS
Standard security frameworks like CIS Controls and NIST 800-53 emphasize patching, access control, and endpoint protection. They do not address residential proxy SDKs because these are not considered malicious by traditional definitions. Three blind spots dominate this threat. Blind spot one: consent mechanisms are structurally inadequate. A popup on a TV screen navigated with a remote control does not constitute informed consent for running a 24/7 proxy relay. Yet both Apple's and Google's app store review processes accept SDK disclosures buried in privacy policies as sufficient. Blind spot two: the supply chain for SDKs is opaque. Developers embed third-party SDKs to monetize free apps, and the SDK vendors often sublicense to white-label resellers. The original developer loses visibility into how the SDK is used. In Vulnox engagements, we traced 14 distinct proxy SDKs from a single streaming app back to three different proxy providers, each performing zero KYC on downstream buyers. Blind spot three: ISP enforcement is paralyzed by economic incentives. ISPs have terms of service prohibiting residential proxies, but enforcing them would require deep packet inspection and would risk losing customers. Most ISPs treat proxy traffic as a nuisance complaint rather than a policy violation.
Let's trace the exploit chain from an end user's perspective. User buys a cheap Android TV box from Amazon with pre-installed apps like 'Cricfy' or 'DooFlix'. One of these apps contains the Popa SDK. On first launch, the app registers the device with a command-and-control server, typically using a domain like gmslb[.]net. The SDK establishes a persistent encrypted WebSocket connection to a relay node. The relay node is an IP address maintained by NetNut or a downstream reseller. Once the device is part of the proxy pool, a NetNut customer (someone who paid for residential IPs) sends a request through NetNut's API. The API selects this TV box as a proxy endpoint. The TV box's public IP becomes the source for the customer's request, which may be scraping a site, launching credential stuffing, or performing ad fraud. The SDK on the TV box does not filter what traffic it forwards; it acts as a simple SOCKS5 proxy. Crucially, the proxy traffic can target devices on the local network of the TV box because the SDK has network access. This enables lateral movement: an attacker scanning for other IoT devices behind the same NAT can launch attacks from inside. Here is a sample of the observed DNS query pattern from Vulnox's telemetry: bash # Typical Popa C2 registration and heartbeat traffic observed in network logs tshark -r capture.pcap -Y 'dns.qry.name matches "gmslb.net|ninjatech.io|safernetwork.io"' -T fields -e ip.src -e ip.dst -e dns.qry.name 192.168.1.100 8.8.8.8 gmslb.net 192.168.1.100 8.8.8.8 ninjatech.io 192.168.1.100 203.0.113.5 safernetwork.io After DNS resolution, the SDK opens a persistent TCP connection to the relay on port 443. The payload is encrypted, but the initial handshake reveals a custom TLS extension indicating the Popa version. Network defenders can detect this by building signatures for the unique TLS handshake fingerprint.
Prevention
Prevention requires coordination across procurement, network, and SOC teams. Standard endpoint antivirus will not catch these SDKs because they are not malware; they are signed applications. Follow this sequence: Step 1: Procurement policy (Legal + IT) Who: Chief Procurement Officer and IT Asset Management What: Require that all network-connected devices—including smart TVs, streaming sticks, and IoT appliances—must be from vendors that certify no proxy SDKs are bundled. Create a whitelist of approved device models. When: Before any device is added to the network. Expected outcome: Eliminate the most common entry point for residential proxy SDKs. Step 2: Network segmentation (Network team) Who: Network Engineering What: Put all IoT/guest devices on a VLAN that has no access to corporate internal resources and has limited outbound connectivity. Use ACLs to block outbound connections to known residential proxy IP ranges (available from threat intel feeds). When: During network architecture review, then enforced continuously. Expected outcome: Even if a device is compromised, the proxy traffic cannot escalate to internal systems. Step 3: DNS-layer detection (SOC) Who: SOC analysts What: Deploy a DNS query monitoring solution that flags queries to domains associated with proxy SDKs. Use publicly available lists from Spur, Synthient, or Include Security. Alert on first query and block subsequent queries with DNS sinkhole. When: Implement immediately, review quarterly for new domains. Expected outcome: Early detection of proxy SDK enrollment before significant bandwidth usage. Step 4: Endpoint detection (Security Engineering) Who: Endpoint security team What: For managed devices (employee phones, laptops), deploy a mobile device management (MDM) policy that prohibits installation of apps embedding known proxy SDKs. Use app reputation services or static analysis to flag SDKs. When: Enforce during device onboarding and continuously via MDM compliance checks. Expected outcome: Prevent proxy enrollment on corporate-managed devices. Most teams skip Step 3 because they assume DNS monitoring is only for malware C2. Residential proxy domains are rarely on blocklists, so teams must proactively add them. Without this step, the first sign of a proxy SDK is often a third-party abuse report.
If you discover that your organization's IP addresses have been used as proxy exit nodes, the response must be coordinated across five roles. The most impactful action per phase is isolating the infected device. The most commonly missed action is documenting the consent (or lack thereof) for the Proxy SDK to inform legal defense. Phase 1: First 24 hours - CISO: Declare incident. Notify legal and PR teams. Approve isolation of infected device from network. Determine whether data breach laws apply (if internal systems were accessed via the proxy). - IR team: Identify the specific device(s) running the proxy SDK. Capture forensic images of the device or application. Preserve network logs showing outbound connections to relay nodes. Block all traffic to those relay IPs at the firewall. - Legal: Prepare a preservation notice for logs. Assess liability under relevant data protection laws (e.g., GDPR Article 32 security of processing). Contact the proxy provider to demand cessation of use of your IP. Phase 2: Days 2–7 - DevOps/IT: Wipe and reimage the affected devices. Update procurement policy to prevent future incidents. Deploy network segmentation for IoT. - SOC: Expand detection rules to cover all domains from threat intel feed for that proxy SDK. Run a retrospective scan of logs to identify any lateral movement from the infected device. - Comms: Draft internal and external communications. If IP was used for malicious purposes (scraping, credential stuffing), prepare a statement for affected third parties. Phase 3: Weeks 2–4 - Legal: Review the proxy SDK's privacy policy and consent flow. Determine if the end user (the employee or visitor who installed the app) gave valid consent. If not, potential for legal action against SDK developer or proxy provider. - CISO: Conduct a post-mortem to identify gaps in procurement or network segmentation. Update risk register. Present findings to board. Handoff moments that stall incidents: The transition from IR to DevOps (when isolating vs. reimaging) is often delayed because DevOps teams are not familiar with the scope of proxy SDKs. Set a hard SLA: isolate within 4 hours, reimage within 48.
Pro tip
After watching multiple organizations chase the wrong threat, a pattern emerged: teams burn weeks trying to block all outbound connections from IoT devices, only to fail because legitimate streaming traffic breaks. The smarter approach is to allow only traffic to known safe destinations (CDNs, streaming endpoints) and block everything else. But that disrupts usability. Here is the tradeoff: proxy SDKs typically need a persistent tunnel to a relay server on port 443. Instead of blocking all HTTPS, use SSL interception (with user consent) to inspect the TLS handshake. The Popa SDK uses a distinctive client hello—a specific set of cipher suites and an SNI that always matches the C2 domain pattern '.net' or '.io'. Write a Zeek script to log any TLS session whose SNI resolves to an IP not in your organization's known CDN whitelist. This catches proxy SDKs without breaking normal traffic. Most teams have the capability but never apply it to this problem.
Three lessons generalize beyond residential proxy botnets. First, consent is not a security control. The industry has outsourced user protection to privacy policies that nobody reads. For any SDK that modifies how a device uses the network, consent must be verifiable, revocable, and bound to the device owner, not a transient user of an app. Second, supply chain security must include monetization models. The reason these SDKs exist is that app developers need revenue. If we do not provide alternative monetization (e.g., tipping, subscriptions), we force developers into ads or data-sharing. Third, the AI economy will continue to drive demand for residential proxies until web scraping becomes impossible or illegal. Security teams must plan for a world where every smart TV is a potential proxy node. The boundary between consumer devices and corporate infrastructure is gone.
Prediction 1: By Q4 2027, at least one major smart TV platform (LG webOS or Samsung Tizen) will ban all third-party SDKs that implement proxy functionality. Spur's data showing 42% of apps with proxy SDKs is too large a liability for these platforms to ignore. They will follow Roku and Amazon's lead. Prediction 2: By mid-2028, a class action lawsuit against an existing residential proxy provider (NetNut or IPIDEA) will succeed on grounds of computer fraud and unauthorized use of residential IPs. The key will be the lack of meaningful consent. The settlement will exceed $50 million and force the industry to adopt verifiable consent mechanisms. Prediction 3 (most controversial): By 2030, AI training companies will be required by regulation in the EU and California to disclose whether they used residential proxies for web scraping. Proxy providers will be forced to maintain immutable logs of customer activity. This will reduce the economic incentive for botnets like Popa, but underground proxy networks will shift to compromised routers and embedded devices with no consent at all.
Frequently Asked Questions
How can I tell if a smart TV app on my network is acting as a proxy node?
Check your firewall logs for persistent outbound connections from the TV's IP to unknown hosts on port 443. Compare the destination IPs against threat intel feeds from Spur or Synthient. You can also use a DNS sinkhole to block known C2 domains like `gmslb.net` or `ninjatech.io` and see if the app generates errors. Additionally, monitor bandwidth usage: if the TV is uploading consistently more than it receives, that's a strong indicator of proxy activity.
What legal liability does my company face if our IP is used for malicious scraping through a proxy SDK installed on a conference room TV?
Liability depends on jurisdiction and whether you had policies preventing such devices. Under GDPR, you are responsible for the security of processing (Article 32). If the scraping targets a publishing platform and they trace the source to your IP, you could receive abuse complaints and be asked to prove you took reasonable steps. If the scraping leads to a DDoS or credential stuffing attack on a third party, you may face tort claims for negligence. The best defense is documented policies, network segmentation, and immediate remediation once detected. Always involve legal counsel early.
Why do AI companies use residential proxies for scraping instead of datacenter IPs?
Datacenter IPs are widely blocked by anti-scraping services like Cloudflare and DataDome because they are known to be non-residential. Residential IPs appear as ordinary home internet connections from ISPs like Comcast or T-Mobile, making it harder to distinguish a legitimate user from a scraping bot. As AI models require vast amounts of training data, companies turn to proxy providers that aggregate these residential IPs to bypass rate limiting and geo-restrictions. The proxy providers, in turn, use SDKs embedded in consumer apps to build these pools.
Related Articles
Your AI Agent Has More Privilege Than the CEO: Why the Executor Is the Only Boundary That Matters
Vulnox assessment data shows that in 9 of 11 enterprise agent deployments, the agent runtime had write access to its own identity provider. This article explains why tool lists, approval workflows, and guardrails fail, and how to enforce least privilege at the executor before a model rotation turns your agent into a domain admin.
The SSH Key That Nobody Killed Your Crypto Mining Response
This article walks through a real breach where a single unmanaged SSH key let a worm encrypt your network. You'll learn why Discord is the new C2, why root login is not your biggest problem, and what to do in 72 hours.
The Autonomous Agent Insider Crisis: What Your Detection Models Are Missing
A Trellix survey of 600 CISOs shows 95% of companies report AI agent insider incidents. Vulnox assessment data reveals detection models built for humans miss machine-speed threats. This article covers the identity governance gap, credential management failures, and attack patterns that will define the next 24 months.
Ready to Secure Your Digital Assets?
Get a comprehensive vulnerability assessment for your website today.