Infoblox Ties Fake 7-Zip and WireVPN Apps to Residential Proxy Network

Researchers said the Lurking Lizard operation has used trojanized software, lookalike domains, fake review sites, and impersonated proxy brands since at least 2022 to turn victim devices into residential proxy nodes. One prominent lure was a counterfeit 7-Zip installer hosted on 7zip[.]com, but investigators also tied the activity to fake installers for WhatsApp, TikTok, YouTube downloader tools, and other software through shared WHOIS records, DNS pivots, backend infrastructure, and a hardcoded IPLogger URL. The campaign is linked to more than 230 domains and appears to run a full proxy business that infects victims and then resells their bandwidth and IP addresses.

The operation later expanded under the WireVPN brand across Windows, macOS, Android, and iOS, including mobile apps distributed through Google Play and the Apple App Store; one Android app reportedly surpassed 1 million downloads. Testing found the software behaved more like proxyware or an exit-node client than a legitimate VPN, contacting numerous unrelated IP addresses and opening many simultaneous connections, while valid code-signing certificates helped it appear trustworthy. Researchers assessed the actor is likely China-based, citing registration data and related artifacts, and warned that the infrastructure supports both victim acquisition and the marketing and sale of fraudulent proxy services.