A smart TV makes an almost perfect proxy. It is always plugged in, always on a high-speed connection, sitting on standby around the clock, rarely watched, unmanaged, with no one checking to whom or what it talks to. Design the ideal host for routing traffic through someone else’s home, and you would land on roughly this.
No one had to. It already exists, in tens of millions of living rooms. Also, an entire industry exists to rent it out from the people who own it, without their knowledge. The mechanism is a kit bundled into an app: a free game, a screensaver, a streaming front-end. Once you agree, it relays someone else’s web traffic through your connection while the device sits idle. The consent screen you clicked on, without even reading the terms and conditions (who does that?), calls this “occasional use” and says it’s using your “spare resources.” Researchers who took one such kit apart found that “occasional use,” in its own configuration, meant a default ceiling of 200 gigabytes a month.
That traffic is mostly commercial web scraping. Some of it is greyer and more entrepreneurial: sneaker bots renting the same homes to buy a “one-per-customer-only” shoe drop forty times over, because forty requests from forty real households read as demand, not a script. The channel does not care what it carries.
Most of this is legal, which is the problem
This industry exists because the alternative does not work: scrapers from data-center addresses get blocked, whereas requests from real homes do not. So, a market formed, and the cleanest way to get a great many homes is to pay app developers to embed a relay kit and harvest their users, a few hundred thousand at a time. The consent, such as it is, exists; the question is what it consents to. Reading a privacy policy with a TV remote is a formality, not a control. And the kit’s idea of “idle” includes, per its own config, even moments when the screen is on but the user is on a phone call. You are, in the context of this ecosystem, idle right now.
The design rewards a closer look. The server hands the device jobs to run — fetch this page, resolve that name — over a persistent connection with no message signing, no client certificate, no device attestation. The researchers’ own dry assessment: less secure than the command-and-control channels used by actual malware. The criminal version authenticates its commands. The legal one does not.
The flip
Everything above is, on paper, legitimate. That is what makes the next part cheap.
A device talked into running a relay kit has done the hard part of becoming a botnet node. The code is running, the channel to a remote server is open and treated as normal, and the traffic reads as ordinary residential noise. The expensive work is done, and somebody else paid for it with the owner’s clicked consent.
Changing what comes down the channel is all that remains: the connection that bought sneakers on Tuesday runs a packet flood on Wednesday, the device none the wiser.
This is neither hypothetical nor gradual. In Nokia Deepfield’s telemetry, the count of devices we see in DDoS attacks had remained roughly 1 million for a long time. Since late 2025, it has climbed in a near-straight line, passing nine million this June and still rising. The climb coincides with the early 2026 disclosure of a residential proxy exposure. The disclosure described a door that was already open; it did not open one.
The ecosystem had long since mapped the territory: which devices are reachable, which channels they tolerate, and how to pass for a subscriber. The access was already provisioned and in use. The surge did not need a vulnerability report; it needed access to a new target, and then the DDoS economy moved in.
The legal and criminal supply are not two separate problems. They are one access surface with two front doors, and one of them has a consent dialog. The same always-on, unwatched device is the ideal scraping relay and the ideal attack node; reaching it is the same work either way. Initial access, provisioned at scale, legally, then handed to whoever changes the instructions.
Rules expire; behavior does not
Notice what never changes: the device’s address. It belonged to a residential subscriber in good standing before the flip and belongs to one after, so reputation scoring, geofencing, and the assumption that home ranges are probably fine were reading a property the attacker never touched.
The natural response is better data: fresher feeds, faster blocklists, maintained, unfortunately, by people who change them faster than you can. The same researchers found a switch in the kit’s config, set to ‘on and waiting’ for a transport it does not yet use: flip it, and the detection built for today’s traffic goes blind. The countermeasure shipped in the same file as the block. That is every fact-named rule. Address, domain, certificate, protocol. Each bets the fact holds long enough to be worth blocking; against an adversary who automates, that bet expires on a schedule the other side sets.
So, you bet instead on the one thing the other side cannot cheaply rotate: behavior. Every fact above can be swapped; what the traffic is doing is harder to disguise: a household device opening a persistent channel to somewhere it has no reason to talk to, a line that starts behaving like a relay, a pattern unremarkable once and damning when repeated ten thousand times. These are shapes, not facts, and they outlast the rotation that kills a blocklist, because an adversary can change what the traffic is far more easily than what it has to accomplish.
Behavior is also the one stage a defender can reach in time. The flood arrives in minutes and is gone — most DDoS events end within five minutes — but the channel that activates it must be opened first, and that takes weeks, which the attacker spends provisioning. Watch for the setup rather than the flood, and you act in those weeks, not the minutes you are otherwise given. Any network can do this at its own edge; you do not have to be a carrier to notice your own devices “phoning” somewhere they shouldn’t.
This is less satisfying than a rule. A rule you tick off; a posture you maintain, retrain, second-guess. But it is the only defense whose shelf life is not set by the other side, which brings us back to the smart TV in the living room. Nothing was ever wrong with the device, the connection, or the address, and that was always the trap. What gave it away was its behavior: the gap between what a TV in standby should be doing and what this one does. That gap is the last signal left. Nothing else about the device will ever look wrong: not the address, not the connection, not the signed consent.
The only warning you get is the behavior itself, and only if someone is watching for it.
About the Author
Jérôme is a security researcher and member of the Nokia Deepfield Emergency Response Team (ERT), tracking DDoS botnets and residential proxy threats to help telecommunications providers, AI and cloud providers, and enterprises strengthen their network security. Based in Paris, he joined Nokia in 2005 in Malaysia, previously handling sales and pre-sales across Asia-Pacific. He holds a Master’s degree from INSA Lyon.
Jérôme can be reached at our company website https://www.nokia.com/people/jerome-meyer/
