Loading story…
Malwarebytes reported a malware distribution campaign in which attackers use a lookalike domain, 7zip[.]com, to impersonate the legitimate 7-Zip download site (7-zip.org) and deliver a trojanized installer that still appears to function as expected. The activity surfaced after a Reddit user described being directed to the fake site via a YouTube tutorial/comment, installing the software on multiple systems, and later receiving a generic Microsoft Defender trojan alert; Malwarebytes’ follow-on analysis concluded that systems running installers from 7zip[.]com should be treated as compromised.
Analysis of the counterfeit installer found it drops additional hidden components (including Uphero.exe, hero.exe, and hero.dll) into C:\Windows\SysWOW64\hero\ and establishes persistence by registering executables as Windows services that start with SYSTEM privileges. The primary payload was assessed as proxyware, turning infected home computers into residential proxy nodes that allow third parties to route traffic through victims’ IP addresses; the malware also includes anti-analysis checks to reduce detection. The installer was observed carrying an Authenticode signature issued to Jozeal Network Technology Co., Limited (reported as revoked), and defenders were advised to watch for unauthorized services and related network activity, and to block known C2/proxy infrastructure where possible.
![Trojanized 7-Zip Installers from 7zip[.]com Used to Deploy Proxyware on Home PCs](/_next/image?url=https%3A%2F%2Fmallory-core-public-images.s3.us-east-2.amazonaws.com%2Ftrojanized-7-zip-installers-from-7zipcom-used-to-deploy-proxyware-on-home-pcs.png&w=3840&q=75)
Get the infrastructure and lures behind it.
5 events from the most recent confirmed update back to the earliest known activity.
After the campaign was publicly disclosed, antivirus vendors updated detections for the malware and the malicious 7zip[.]com domain was added to ad-blocking rulesets, including ones used by uBlock Origin. These actions were intended to reduce further user exposure to the fake download site.
Analysis tied the 7-Zip impersonation to a wider operation using trojanized installers themed as other popular software and services, including HolaVPN, TikTok, WhatsApp, and Wire. The campaign used anti-analysis checks, Cloudflare-fronted C2 traffic, and non-standard proxy ports to reduce detection and support third-party traffic tunneling.
Malwarebytes found the fake installer dropped components including Uphero.exe, hero.exe, and hero.dll, created SYSTEM-level Windows services, changed firewall rules, profiled hosts, and contacted "smshero"-themed infrastructure. The company assessed the malware's main purpose as converting infected Windows systems into residential proxy nodes and warned systems that ran the installer should be treated as compromised.
The campaign came to light after a Reddit user reported downloading 7-Zip from 7zip[.]com after following a YouTube PC-building tutorial link or comment. The user later received a Microsoft Defender trojan alert, indicating compromise.
Adversaries took control of the long-registered domain 7zip[.]com and used it to impersonate the legitimate 7-Zip project. The site hosted trojanized installers that appeared to provide normal 7-Zip functionality while delivering malware.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecybersecuritynews.com
Open sourcehelpnetsecurity.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are abusing **software-brand impersonation** to trick users into installing malware from fake distribution points, relying on social engineering rather than software exploits. Datadog reported an active campaign using **fake GitHub repositories** that impersonate established technology companies and leverage the **ClickFix** technique—prompting victims to copy/paste commands into *Terminal* (macOS) or *PowerShell/Run* (Windows)—to install infostealers. Datadog observed iterative updates to the *MacSync* lure and a new macOS infostealer variant self-branded as **“SHub Stealer v2.0”**, with expanded capabilities including **persistence** and **remote access**, alongside anti-analysis/evasion features intended to hinder detection and track infection outcomes; Datadog also assessed signs the actor is expanding toward **Windows infostealer** functionality. Separately, Malwarebytes documented a lookalike **7-Zip** download site (`7zip[.]com`, impersonating the legitimate `7-zip.org`) distributing a **trojanized installer** that installs a working 7-Zip File Manager while silently converting infected Windows systems into **residential proxy nodes**. The installer was **Authenticode-signed** with a certificate issued to **Jozeal Network Technology Co., Limited** (now revoked), and it dropped additional components—`Uphero.exe` (service manager/update loader), `hero.exe` (Go-compiled proxy payload), and `hero.dll`—under `C:\Windows\SysWOW64\hero\`; one reported case surfaced via Microsoft Defender detection `Trojan:Win32/Malgent!MSR` after the system had been exposed for an extended period. Together, the reporting highlights a sustained risk from **trusted-brand impersonation** and “looks legitimate” installers/repositories that deliver credential theft or monetize endpoints via proxyware.
Jul 2, 2026
Researchers said the **Lurking Lizard** operation has used trojanized software, lookalike domains, fake review sites, and impersonated proxy brands since at least 2022 to turn victim devices into residential proxy nodes. One prominent lure was a counterfeit **7-Zip** installer hosted on `7zip[.]com`, but investigators also tied the activity to fake installers for WhatsApp, TikTok, YouTube downloader tools, and other software through shared WHOIS records, DNS pivots, backend infrastructure, and a hardcoded **IPLogger** URL. The campaign is linked to more than **230 domains** and appears to run a full proxy business that infects victims and then resells their bandwidth and IP addresses. The operation later expanded under the **WireVPN** brand across **Windows, macOS, Android, and iOS**, including mobile apps distributed through **Google Play** and the **Apple App Store**; one Android app reportedly surpassed **1 million downloads**. Testing found the software behaved more like proxyware or an exit-node client than a legitimate VPN, contacting numerous unrelated IP addresses and opening many simultaneous connections, while valid code-signing certificates helped it appear trustworthy. Researchers assessed the actor is likely **China-based**, citing registration data and related artifacts, and warned that the infrastructure supports both victim acquisition and the marketing and sale of fraudulent proxy services.
Jul 12, 2026
Attackers have set up more than 70 lookalike websites impersonating popular Windows utility and customization apps, including **Wintoys**, **PowerToys**, **WinUtil**, **EasyBCD**, **CrystalDiskMark**, **Lively Wallpaper**, and **SignalRGB**, to lure users searching for downloads. The campaign was uncovered after Wintoys developer **Bogdan Pătrăucean** identified a cloned site for his app and traced it to a wider domain cluster linked by the anonymized WHOIS contact `43345@anonymize.com`, with operators reportedly shifting domains to a new registrar after scrutiny. Researchers said the sites use a staged approach: some initially serve legitimate installers to build trust, then later replace them with malicious downloads. Observed payloads include trojanized installers, persistent **ScreenConnect** remote-access software, **RemusStealer**, **AnimateClipper**, and bandwidth-sharing software, while proxy-backed hosting has helped keep parts of the infrastructure online. Some domains have been flagged by **Cloudflare** or added to **Hagezi** blocklists, but many remain active, increasing the risk for users who download Windows apps from search results instead of official developer pages or the Microsoft Store.
Jul 27, 2026