A Pac-Man game. That’s what it took to expose a serious privacy problem hiding inside millions of Samsung smart TVs. Not some obscure third-party app buried in a forgotten corner of the store, but a game Samsung itself had endorsed and featured in its “Editor’s Choice” section. And according to new security research, it contained code designed to route other people’s internet traffic through your home connection without you knowing.
As TechCrunch reported, the research comes from Norwegian cybersecurity firm Mnemonic, which found that several apps available on Samsung’s smart TV platform contained residential proxy software, known as resproxy code. When a user opens one of these apps, the TV can be turned into an exit node, a tunnel through which strangers route their web traffic using your home internet address. And the app doesn’t even need to be open for this to keep running.
Harrison Sand, an offensive security consultant at Mnemonic, rooted a Samsung smart TV to analyze all network traffic flowing in and out of the device. He found that the Pac-Man game contained resproxy code from Bright Data, an Israel-based company that sells access to proxy networks and scraped datasets. The code activated when a user accepted a consent screen inside the app, after which it ran silently in the background. Sand observed traffic patterns suggesting the network was used heavily for scraping LinkedIn profiles and collecting AI training data.
But the more alarming finding wasn’t about what the code was doing. It was about what it could do. Sand warned that a simple change to a web server could activate hundreds of millions of enlisted TVs simultaneously, turning them into a botnet. The apps themselves are often thin shells, just a few lines of code that load content from an external server. Reviewing the app code tells you nothing about what actually runs when someone opens it. “What was reviewed is not necessarily what is running,” Sand wrote.
After TechCrunch contacted Samsung for comment, the company said it was banning apps that incorporate residential proxy functionality and would remove existing ones from its store. That’s a reasonable response, but it raises an obvious question: how did Samsung-endorsed apps containing this code get through in the first place? The answer points to a structural weakness in how app stores review software that loads its real behavior from external servers.
Resproxies aren’t automatically illegal. They’re used to bypass censorship, conduct market research, and, increasingly, to train AI models by scraping data from multiple sources at scale. But cybersecurity researchers have also tied them to cyberattacks and espionage, precisely because the traffic looks like it’s coming from an ordinary home rather than a malicious actor. The encrypted nature of that traffic makes it nearly impossible to inspect.
This is also not just a Samsung problem. LG faced similar scrutiny last month after researchers found that roughly 42% of apps on its platform were enlisting smart TVs into proxy networks. The same resproxy code has been found in phone apps, digital photo frames, and Android streaming boxes. The pattern is consistent: consumer devices with always-on internet connections are a valuable commodity for anyone wanting to launder their web traffic through residential IP addresses.
Samsung’s ban is a start. But until app stores can reliably audit what code actually executes at runtime, not just what’s submitted for review, users have no real way to know what their televisions are doing on their behalf.