Your Router Might Be Working for Someone Else

From time to time, you might be using an application and come across an action or item that looks new to you. Usually you’d think to yourself, “Hey! This is cool! This must be a new feature... damn, or a bug.” But thanks to modern-day tech, it could be malware, too.

Since vibe coding has become the current thing us nerds are doing, the bad guys are doing it too. Their current attack surface is open source software and “vibe coding.” As they say, with great power comes great consequences, if you don’t keep up with the latest tech news or know how to check your work.

Let me introduce you to SocksEscort. According to the Justice Department, on March 12, 2026:

“Since the summer of 2020, SocksEscort has offered to sell access to about 369,000 different IP addresses. As of February 2026, the SocksEscort application listed approximately 8,000 infected routers to which its customers could buy access, of those, 2,500 were in the United States.”

You may be thinking, well, what’s the big deal with someone else using my internet connection? There are a lot of reasons you don’t want someone doing that. One of them: they might be doing something very bad, and want to hide behind your network and pretend to be someone they’re not.

One of the tools used to block unwanted access to a network is the firewall. If an IP address abuses the connection it’s trying to get on, the firewall does what it’s told and blocks that IP address. For a long time, cyber criminals used their own connections, or connections they trusted. That usually meant they had access to one or two IP addresses (maybe a few more, but not thousands). So SocksEscort thought, “Hey, we could build a proxy network that runs on consumer hardware, and use people’s home internet connections and IP addresses to attack the systems we want to attack.”

Taking it down was a global effort. The DOJ credits Europol, Eurojust, and authorities in Austria, Bulgaria, France, Germany, Hungary, the Netherlands, and Romania.

But here’s the catch: 2,500 of those infected routers were right here in the United States. One of the tricks we used to rely on was geo-blocking, where the firewall blocks a connection based on where the IP address is located. Well, now the call is coming from inside the house, and we have to figure out how to fix this. The firewalls haven’t changed, so now if we block those IP addresses, we’re also blocking legitimate people who might be trying to reach our services.

One of the problems is that the internet was never made to be secure. The people who built it didn’t think people would want to do dirty, nasty things on it. So security is never the “first thing that comes to mind” when building things. Kind of like what’s going on in the “AI” world right now. We decided to move fast, break things, and fix them later. That’s fine for profit, but not for the people using the product.

Smart TVs are having the same issue, according to Steve Gibson on Security Now, just in a more “legitimate” way. It’s still nasty. Bright Data sells an SDK that app developers can put in their apps, which lets Bright Data use their customers’ internet connections to scrape and crawl the web, and it runs on Samsung’s and LG’s TV platforms. And since EVERYONE reads every Terms of Service they agree to, I’m sure there was some wording in there about this SDK and how it could be used. But thanks to how cryptic those terms are, everyone just scrolls to the bottom and clicks Agree.