Proxy Back Malware Turns User Systems Into Proxies Without Consent
Summary: Palo Alto Networks researchers identified a malware family called ProxyBack, with more than 20 versions observed infecting systems since March 2014, distributed mainly in Europe and mostly targeting educational institutions. ProxyBack builds a reverse TCP tunnel to an attacker-controlled proxy server so the compromised machine makes the initial outbound call, and its GET requests carry the User-Agent string "pb"; a sequentially incrementing victim ID rose by 11,149 during the analysis.
What's compelling: That 11,149 increment may indicate the number of victim proxies compromised, and captured traffic showed the victim machine relaying requests from automated systems creating fake accounts across dating sites such as match.com and okcupid.com, with the victim listed for sale on buyproxy.ru.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026