Jaguar

Jaguar is a residential proxy malware family and service operated by a Chinese company. It uses compromised Android devices, including Android TV set-top boxes, as proxy endpoints capable of relaying TCP and UDP traffic. Its distribution relies on preinstalled Android backdoors, and its proxy components have been identified within the ABCNexus loader used in the XCPE ecosystem. Jaguar's observed device population is predominantly outside China.

Jaguar includes a Java TCP/UDP proxy SDK and a 32-bit native ELF component integrated through JNI. Within ABCNexus, a service extracts the embedded native component for deployment. The native implementation derives a ChaCha20 configuration-decryption key using ARM NEON instructions and establishes encrypted command-and-control communications. Jaguar monetizes compromised devices by making their network connectivity available for residential traffic relay.