Malicious Android Apps Turned Phones Into Residential Proxy Nodes
Malware Intelligence · 2 sources · Updated 4mo ago · First seen May 25, 2026
Researchers reported that malicious Android applications, including VPN-themed apps and software built with the LumiApps SDK, secretly enrolled users’ devices into a proxy network and routed third-party traffic through them without informed consent. HUMAN’s Satori team said the operation, tracked as PROXYLIB, used a Golang-based native library, libgojni.so, to contact command-and-control servers, register infected phones, and maintain persistent proxy connections through Android services and boot receivers.
The activity was linked to earlier infections found in Oko VPN and 28 related Google Play apps, as well as a later variant that could be embedded during app development or injected into APKs without source-code access. Investigators said the infrastructure and monetization appeared tied to Asocks, a residential proxy service, indicating the compromised devices were likely being sold as proxy exit nodes for cybercriminal use. Google removed the identified apps from Google Play, and Google Play Protect now detects or blocks known PROXYLIB-related applications, while researchers warned the operators are likely to keep shifting to third-party app stores and modified APK distribution.
