Fake 7-Zip Installers Turn Devices Into Residential Proxy Nodes
Summary: Infoblox disclosed a China-based threat actor it calls Lurking Lizard, which has run a residential proxy operation since at least August 2022 across more than 230 lookalike domains, including a trojanized 7-Zip installer hosted on "7zip[.]com" that recruited compromised devices as proxy nodes. The same infrastructure served fake installers for WhatsApp, TikTok and YouTube downloader tools, and WireVPN, and an Android app branded "wirevpn - Fast Unlimited Proxy" under U.K.-registered WIRE LTD has more than 1 million downloads, though Infoblox analyzed only Windows samples and WireVPN disputes the findings.
Key Takeaway: A single actor has run victim acquisition, proxy infrastructure, marketing and monetization for several years, and Google's takedown of the NetNut network it cites involved at least 2 million devices turned into conduits - meaning home IP addresses used as attack launchpads can get legitimate traffic flagged or blocked by service providers.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026