Kookeey

Kookeey is a large malicious residential proxy service and botnet cluster assessed to be operated by Chinese actors. It has been observed at roughly 1.5 to 2 million compromised IP addresses per day, placing it among the larger proxy botnets in the criminal proxy ecosystem. The service relies on compromised Android devices and has been associated with silent APK installation to build and maintain its proxy pool. Like other major malicious proxy providers, it appears to function within a broader supply chain in which operators may both control infected devices directly and resell proxy access. Kookeey infrastructure has been linked to criminal operations beyond simple proxy resale. Its proxies have been used to support brute-force activity against Microsoft login services, indicating use for password spraying and related initial-access operations. It has also been used by a Vietnam-based fraud actor to validate and monetize stolen payment card data, showing utility for fraud enablement and traffic obfuscation. The broader ecosystem in which Kookeey operates is characterized by resilient, large-scale abuse of compromised consumer devices, especially Android endpoints, and by operational practices consistent with Chinese-operated proxy services, including exclusion of mainland China from victim pools.