Loading story…
Researchers said the Lurking Lizard operation has used trojanized software, lookalike domains, fake review sites, and impersonated proxy brands since at least 2022 to turn victim devices into residential proxy nodes. One prominent lure was a counterfeit 7-Zip installer hosted on 7zip[.]com, but investigators also tied the activity to fake installers for WhatsApp, TikTok, YouTube downloader tools, and other software through shared WHOIS records, DNS pivots, backend infrastructure, and a hardcoded IPLogger URL. The campaign is linked to more than 230 domains and appears to run a full proxy business that infects victims and then resells their bandwidth and IP addresses.
The operation later expanded under the WireVPN brand across Windows, macOS, Android, and iOS, including mobile apps distributed through Google Play and the Apple App Store; one Android app reportedly surpassed 1 million downloads. Testing found the software behaved more like proxyware or an exit-node client than a legitimate VPN, contacting numerous unrelated IP addresses and opening many simultaneous connections, while valid code-signing certificates helped it appear trustworthy. Researchers assessed the actor is likely China-based, citing registration data and related artifacts, and warned that the infrastructure supports both victim acquisition and the marketing and sale of fraudulent proxy services.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
The activity later evolved into a WireVPN-branded offering distributed across Windows, macOS, Android, iOS, Google Play, and the Apple App Store. Reports said the Android app had more than 1 million downloads and testing showed behavior more consistent with proxy exit-node abuse than a legitimate VPN.
An early-2026 campaign used a trojanized 7-Zip installer hosted on 7zip[.]com to infect users and enroll their devices into the proxy network. Investigators later linked this lure to the broader Lurking Lizard ecosystem through shared infrastructure and tracking artifacts.
Researchers said the Lurking Lizard operation has been active since at least August 2022, using trojanized installers, lookalike domains, and fake brands to turn victim devices into residential proxy nodes and monetize their bandwidth.
Infoblox disclosed a report detailing the Lurking Lizard operation, linking more than 230 domains, fake installers, fake review sites, and impersonated proxy services to a single end-to-end malicious residential proxy business. The report also assessed the actor as likely China-based based on registration and infrastructure artifacts.
A Japanese SOC reported that in January 2026 the unofficial 7zip[.]com site pointed Windows x64 and x86 downloads to a suspicious installer that dropped files into C:\Windows\SysWOW64\hero and registered hero.exe as a SYSTEM-starting Helper Service. The malicious download links were reportedly changed back to the official 7-zip.org site on 2026-01-26.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcethehackernews.com
Open sourcecyberveille.ch
Open sourcecryptika.com
Open sourceinfoblox.com
Open sourceqiita.com
Open sourcewizsafe.iij.ad.jp
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported multiple campaigns using fake download and streaming sites to compromise users with remote access tools, malware, and proxyware. Kaspersky found more than 90 spoofed domains in 10 languages promoting bogus Windows software downloads through search engine optimization; the delivered archives used DLL sideloading to install the expected application alongside **ScreenConnect**, then deployed **AsyncRAT** for persistent access. In one investigated case, the attackers altered Microsoft Defender exclusions, disabled User Account Control, and used process hollowing into `RegAsm.exe` to launch the payload, creating risk for both consumers and enterprise networks because remote administration tools are often allowlisted and may run with elevated privileges. A parallel set of campaigns abused demand for free media and utilities to lure victims into installing unwanted software that can expose systems and internet connections to criminal use. Researchers tracking World Cup-themed piracy sites found rotating mirror domains, typosquatting, and cloud-hosted pages pushing fake **Stremio** installers, VPN-themed lures, and affiliate-style downloads tied to malware, phishing, and scams. Separate analysis of a fake **7-Zip** installer showed a Go-based backdoor that converted infected Windows hosts into residential proxy nodes, while broader threat reporting warned that free VPNs, streaming apps, browser extensions, and cheap IoT products are increasingly used to build residential proxy networks that criminals exploit for fraud, scraping, account abuse, and evasion.
Jul 12, 2026![Trojanized 7-Zip Installers from 7zip[.]com Used to Deploy Proxyware on Home PCs](/_next/image?url=https%3A%2F%2Fmallory-core-public-images.s3.us-east-2.amazonaws.com%2Ftrojanized-7-zip-installers-from-7zipcom-used-to-deploy-proxyware-on-home-pcs.png&w=3840&q=75)
Malwarebytes reported a malware distribution campaign in which attackers use a lookalike domain, **7zip[.]com**, to impersonate the legitimate 7-Zip download site (*7-zip.org*) and deliver a trojanized installer that still appears to function as expected. The activity surfaced after a Reddit user described being directed to the fake site via a YouTube tutorial/comment, installing the software on multiple systems, and later receiving a generic Microsoft Defender trojan alert; Malwarebytes’ follow-on analysis concluded that systems running installers from **7zip[.]com** should be treated as compromised. Analysis of the counterfeit installer found it drops additional hidden components (including `Uphero.exe`, `hero.exe`, and `hero.dll`) into `C:\Windows\SysWOW64\hero\` and establishes persistence by registering executables as **Windows services** that start with **SYSTEM** privileges. The primary payload was assessed as **proxyware**, turning infected home computers into **residential proxy nodes** that allow third parties to route traffic through victims’ IP addresses; the malware also includes anti-analysis checks to reduce detection. The installer was observed carrying an Authenticode signature issued to **Jozeal Network Technology Co., Limited** (reported as revoked), and defenders were advised to watch for unauthorized services and related network activity, and to block known C2/proxy infrastructure where possible.
Jun 29, 2026
Researchers reported that malicious Android applications, including VPN-themed apps and software built with the **LumiApps** SDK, secretly enrolled users’ devices into a proxy network and routed third-party traffic through them without informed consent. HUMAN’s Satori team said the operation, tracked as **PROXYLIB**, used a Golang-based native library, `libgojni.so`, to contact command-and-control servers, register infected phones, and maintain persistent proxy connections through Android services and boot receivers. The activity was linked to earlier infections found in **Oko VPN** and 28 related Google Play apps, as well as a later variant that could be embedded during app development or injected into APKs without source-code access. Investigators said the infrastructure and monetization appeared tied to **Asocks**, a residential proxy service, indicating the compromised devices were likely being sold as proxy exit nodes for cybercriminal use. Google removed the identified apps from Google Play, and **Google Play Protect** now detects or blocks known PROXYLIB-related applications, while researchers warned the operators are likely to keep shifting to third-party app stores and modified APK distribution.
Jun 29, 2026