Bright Data SDK Abuse: Smart TVs and Mobile Devices Hijacked for AI Scraping

Introduction

A recent revelation regarding the inner workings of the Bright Data (formerly Luminati) SDK has sent shockwaves through the cybersecurity community. Researchers have reverse-engineered the iOS SDK embedded in numerous "free" consumer applications, uncovering a mechanism that transforms devices—including always-on smart TVs—into exit nodes for a massive residential proxy network.

While Bright Data markets this infrastructure as essential for AI data scraping and business intelligence, the implications for enterprise security are severe. Devices operating on corporate networks (BYOD) or within smart building ecosystems are unknowingly relaying third-party web traffic. This functionality exposes organizations to data exfiltration risks, legal liability associated with the traffic exiting their IP space, and significant degradation of bandwidth. Defenders must immediately identify and neutralize this supply-chain threat.

Technical Analysis

Affected Platforms and Products:

Mobile: iOS applications embedding the Bright Data SDK.
IoT/OTT: Smart TVs and set-top boxes running modified Android (Android TV), Tizen, or webOS operating systems where the SDK is integrated into firmware or pre-installed apps.

Threat Mechanism:

SDK Integration: The attack vector begins with the inclusion of the Bright Data SDK in legitimate-looking, free applications. Once the user installs and launches the app, the SDK initializes a background service.
Proxy Node Creation: The device establishes a persistent connection to Bright Data's super-proxy infrastructure. It then listens for inbound connections destined for external websites. The device effectively acts as a relay, forwarding requests from Bright Data's customers (often AI firms) to the target internet and returning the response.
Traffic Obfuscation: Because the traffic originates from a residential IP (the TV or mobile device), it bypasses standard IP-based blocklists and geofences, making it highly valuable for scrapers but difficult to distinguish from normal user activity for the uninitiated analyst.

Exploitation Status:

In-the-Wild: Confirmed active usage in consumer apps and smart TV firmware.
CVE Status: No CVE is assigned. This is not a software vulnerability in the traditional sense (buffer overflow, RCE), but rather a functionality abuse authorized by the End User License Agreement (EULA) and obfuscated from the user. This falls under the category of "Threat via Policy/Misconfiguration." However, for defenders, the behavior functionally resembles that of a botnet.

Detection & Response

Detecting this activity requires focusing on the network anomalies and process artifacts associated with the SDK's operation. Unlike standard malware, these processes are often signed and ostensibly legitimate, making behavioral heuristics critical.

SIGMA Rules

The following rules target the Linux/Android subsystems common in Smart TVs and the network behavior characteristic of proxy tunneling.

YAML

---
title: Potential Bright Data/Luminati Proxy Process
id: 8a4b2c91-6f3e-4a1c-9d5e-2f3a4b5c6d7e
status: experimental
description: Detects the execution of known binaries or background processes associated with the Bright Data (Luminati) SDK on Linux/Android-based IoT devices.
references:
 - https://thehackernews.com/2026/06/free-apps-are-quietly-turning-smart-tvs.html
author: Security Arsenal
date: 2026/06/18
tags:
 - attack.command_and_control
 - attack.t1071.001
logsource:
 category: process_creation
 product: linux
detection:
 selection:
   Image|contains:
     - 'luminati'
     - 'brightdata'
     - 'bd_sdk'
   or
   CommandLine|contains:
     - '--proxy'
     - '--port'
 condition: selection
falsepositives:
 - Legitimate administrative use of proxy tools (rare on TVs)
level: high
---
title: Suspicious Outbound Proxy Traffic Pattern
id: 9c5d3e02-0g4f-5b2d-0e6f-3g4b5c6d7e8f
status: experimental
description: Detects high-volume or persistent outbound connections to known Bright Data proxy infrastructure or non-standard proxy ports from user-space processes.
references:
 - https://thehackernews.com/2026/06/free-apps-are-quietly-turning-smart-tvs.html
author: Security Arsenal
date: 2026/06/18
tags:
 - attack.exfiltration
 - attack.t1048.003
logsource:
 category: network_connection
 product: linux
detection:
 selection_ports:
   DestinationPort:
     - 22225
     - 24000
     - 25345
 selection_domains:
   DestinationHostname|endswith:
     - '.brd.tech'
     - '.luminati.io'
 condition: 1 of selection_*
falsepositives:
 - Legitimate corporate proxy usage
level: medium

KQL (Microsoft Sentinel / Defender)

This hunt query identifies devices communicating with infrastructure commonly associated with residential proxy networks. It assumes you are ingesting CommonSecurityLog (firewall/proxy) or DeviceNetworkEvents (Microsoft Defender for IoT).

KQL — Microsoft Sentinel / Defender

// Hunt for Smart TV/IoT devices contacting Bright Data infrastructure
let ProxyIOCs = dynamic(['.brd.tech', '.luminati.io', 'brightdata.com', 'luminati.com']);
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where DeviceCategory in ('Smart TV', 'IoT', 'Mobile')
| where RemoteUrl has_any (ProxyIOCs) or RemotePort in (22225, 24000, 25345)
| project Timestamp, DeviceName, DeviceId, InitiatingProcessAccountName, RemoteUrl, RemotePort, BytesSent, BytesReceived
| summarize TotalConnections=count(), TotalBytesSent=sum(BytesSent), TotalBytesReceived=sum(BytesReceived) by DeviceName, InitiatingProcessAccountName, RemoteUrl
| order by TotalBytesSent desc

Velociraptor VQL

Use this artifact to hunt for the presence of SDK files or configuration artifacts on Linux-based endpoints (such as Android TV or Tizen Linux shells).

VQL — Velociraptor

-- Hunt for Bright Data/Luminati SDK artifacts on Linux/IoT endpoints
SELECT FullPath, Size, Mtime, Mode
FROM glob(globs='/opt/*luminati*', '/usr/lib/*brightdata*', '/data/data/*/libbd*.so', '/system/app/*Luminati*')
WHERE Mode =~ 'rwx'

-- Hunt for running proxy processes
SELECT Pid, Name, Exe, Cmdline, Username
FROM pslist()
WHERE Name =~ 'luminati' 
   OR Name =~ 'bd_sdk'
   OR Cmdline contains 'proxy'
   OR Exe contains 'brightdata'

Remediation Script (Bash)

Run this script on Linux-based IoT devices or Android shells to identify and terminate active proxy processes related to this threat.

Bash / Shell

#!/bin/bash

# Remediation script for Bright Data/Luminati Proxy SDK on Linux/Android
# Identify processes matching SDK signatures

PROCESSES=$(ps aux | grep -E 'luminati|brightdata|bd_sdk' | grep -v grep)

if [ -n "$PROCESSES" ]; then
    echo "[!] Detected suspicious proxy processes:"
    echo "$PROCESSES"
    
    # Attempt to kill processes by name (Use with caution on production IoT)
    pkill -f luminati
    pkill -f brightdata
    pkill -f bd_sdk
    
    echo "[+] Processes terminated. Please review installed packages for persistence."
else
    echo "[+] No detected proxy processes running."
fi

# Optional: Block known IPs at iptables level (Requires root)
# iptables -A OUTPUT -d brd.tech -j REJECT

Remediation

Network Segmentation: Immediately move Smart TVs and untrusted IoT devices onto a separate VLAN (Guest/IoT network) that restricts direct internet access or isolates them from the internal corporate network.
DNS Filtering: Implement DNS sinkholing for domains associated with Bright Data (e.g., *.brd.tech, *.luminati.io). This effectively breaks the command-and-control channel for the SDK.
Application Audit: Conduct an audit of mobile applications allowed on corporate BYOD devices. Block or uninstall applications known to embed the Bright Data SDK.
Firmware Hardening: For Smart TVs, check for firmware updates that may include privacy patches, or audit the pre-installed application list. If possible, disable "unused" features or apps within the TV settings that may act as data relays.
Proxy Inspection: Configure outbound SSL inspection on the corporate web proxy. While the SDK traffic may be encrypted, the volume and connection patterns (high connection count to few destinations) will stand out against normal user behavior.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub