Free games and apps from Lithuanian publisher Appsalt can route other people’s internet traffic through users’ devices.
Spur Intelligence researchers also found that an earlier version of the publisher’s picture-in-picture Chrome extension collected browsing history, Google search results, and ChatGPT conversations.
The investigation began with Cinema HQ, a free streaming app. Spur said the app starts the Appsalt and EarnFM proxy components even when users turn off its “Share Resources” setting. The toggle controls a third proxy component, Hopmn.
Appsalt is operated by Vilnius-based Beellet UAB, which offers developers a software development kit (SDK) that monetizes users’ bandwidth and IP addresses. The SDK turns devices into residential proxies, allowing customers to send web requests that appear to come from a user’s internet connection.
Chrome extension switched from tracking to proxying
Spur found that version 0.2.0 of Appsalt’s Picture-in-Picture Extension, downloaded from the Chrome Web Store on October 21, sent browsing history, open tabs, and details of newly loaded pages to a remote server. It also collected content from ChatGPT conversations and Google search results, including AI Overviews. Spur found no consent prompt or user-facing setting to disable the collection.
Two days later, version 0.4.0 replaced the data collection code with a browser proxy called Node Pointer SDK. Spur found proxy code in three other Appsalt extensions: MP3 Cut, Google Search Console Enhancer, and TeraBox Link Saver. Both MP3 Cut and the updated Picture-in-Picture extension enabled proxy consent before asking users. In MP3 Cut, closing the prompt left the proxy enabled.
Spur
Silent audio kept iPhone games running
All 12 iPhone apps Spur examined contained Appsalt’s SDK. Eleven shipped a silent audio file and declared background audio support. Spur found code in ten Unity games that looped the silent track when users switched away, keeping the games running in the background. None of the 12 App Store privacy labels mentioned bandwidth sharing. Apple’s review guidelines restrict background services to their intended uses.
One of those apps, Couples Game, had nearly 29,000 downloads before Beellet acquired it for $7,000, according to Spur. The first update under Beellet, released in March 2026, added the proxy SDK under release notes describing minor fixes and improvements.
Spur also found the SDK in the Steam builds of Wattverse and Farm Story Life. The desktop games Spur examined required consent before proxying, but closing their windows could leave them running in the system tray or menu bar. On Windows, accepting with the default startup setting enabled also registered the games to launch at login.
Appsalt linked to Honeygain’s proxy network
Spur linked Appsalt’s SDK to Honeygain, a subsidiary of commercial proxy provider Oxylabs, through matching code, developer documentation, and overlapping server infrastructure. The researchers could not establish the exact business relationship or determine how many of the 8.3 million IP addresses they identified as Oxylabs exits came from Appsalt.
Oxylabs told Spur it audits partners and cuts ties over serious breaches, including fabricated consent. It also said it plans to launch a paid program for reporting abuse in how devices are recruited into its network.
Users who want to stop sharing bandwidth can uninstall the affected apps or extensions and check their desktop startup settings for entries the games added. Spur’s IP lookup tool can show whether it has observed an address in a proxy network.
Leave a Reply