Loading story…
Malwarebytes reported a malware distribution campaign in which attackers use a lookalike domain, 7zip[.]com, to impersonate the legitimate 7-Zip download site (7-zip.org) and deliver a trojanized installer that still appears to function as expected. The activity surfaced after a Reddit user described being directed to the fake site via a YouTube tutorial/comment, installing the software on multiple systems, and later receiving a generic Microsoft Defender trojan alert; Malwarebytes’ follow-on analysis concluded that systems running installers from 7zip[.]com should be treated as compromised.
Analysis of the counterfeit installer found it drops additional hidden components (including Uphero.exe, hero.exe, and hero.dll) into C:\Windows\SysWOW64\hero\ and establishes persistence by registering executables as Windows services that start with SYSTEM privileges. The primary payload was assessed as proxyware, turning infected home computers into residential proxy nodes that allow third parties to route traffic through victims’ IP addresses; the malware also includes anti-analysis checks to reduce detection. The installer was observed carrying an Authenticode signature issued to Jozeal Network Technology Co., Limited (reported as revoked), and defenders were advised to watch for unauthorized services and related network activity, and to block known C2/proxy infrastructure where possible.
![Trojanized 7-Zip Installers from 7zip[.]com Used to Deploy Proxyware on Home PCs](/_next/image?url=https%3A%2F%2Fmallory-core-public-images.s3.us-east-2.amazonaws.com%2Ftrojanized-7-zip-installers-from-7zipcom-used-to-deploy-proxyware-on-home-pcs.png&w=3840&q=75)
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
After the campaign was publicly disclosed, antivirus vendors updated detections for the malware and the malicious 7zip[.]com domain was added to ad-blocking rulesets, including ones used by uBlock Origin. These actions were intended to reduce further user exposure to the fake download site.
Analysis tied the 7-Zip impersonation to a wider operation using trojanized installers themed as other popular software and services, including HolaVPN, TikTok, WhatsApp, and Wire. The campaign used anti-analysis checks, Cloudflare-fronted C2 traffic, and non-standard proxy ports to reduce detection and support third-party traffic tunneling.
Malwarebytes found the fake installer dropped components including Uphero.exe, hero.exe, and hero.dll, created SYSTEM-level Windows services, changed firewall rules, profiled hosts, and contacted "smshero"-themed infrastructure. The company assessed the malware's main purpose as converting infected Windows systems into residential proxy nodes and warned systems that ran the installer should be treated as compromised.
The campaign came to light after a Reddit user reported downloading 7-Zip from 7zip[.]com after following a YouTube PC-building tutorial link or comment. The user later received a Microsoft Defender trojan alert, indicating compromise.
Adversaries took control of the long-registered domain 7zip[.]com and used it to impersonate the legitimate 7-Zip project. The site hosted trojanized installers that appeared to provide normal 7-Zip functionality while delivering malware.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecybersecuritynews.com
Open sourcehelpnetsecurity.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are abusing **software-brand impersonation** to trick users into installing malware from fake distribution points, relying on social engineering rather than software exploits. Datadog reported an active campaign using **fake GitHub repositories** that impersonate established technology companies and leverage the **ClickFix** technique—prompting victims to copy/paste commands into *Terminal* (macOS) or *PowerShell/Run* (Windows)—to install infostealers. Datadog observed iterative updates to the *MacSync* lure and a new macOS infostealer variant self-branded as **“SHub Stealer v2.0”**, with expanded capabilities including **persistence** and **remote access**, alongside anti-analysis/evasion features intended to hinder detection and track infection outcomes; Datadog also assessed signs the actor is expanding toward **Windows infostealer** functionality. Separately, Malwarebytes documented a lookalike **7-Zip** download site (`7zip[.]com`, impersonating the legitimate `7-zip.org`) distributing a **trojanized installer** that installs a working 7-Zip File Manager while silently converting infected Windows systems into **residential proxy nodes**. The installer was **Authenticode-signed** with a certificate issued to **Jozeal Network Technology Co., Limited** (now revoked), and it dropped additional components—`Uphero.exe` (service manager/update loader), `hero.exe` (Go-compiled proxy payload), and `hero.dll`—under `C:\Windows\SysWOW64\hero\`; one reported case surfaced via Microsoft Defender detection `Trojan:Win32/Malgent!MSR` after the system had been exposed for an extended period. Together, the reporting highlights a sustained risk from **trusted-brand impersonation** and “looks legitimate” installers/repositories that deliver credential theft or monetize endpoints via proxyware.
Jul 2, 2026
Researchers reported that a threat actor tracked as **Lurking Lizard** has been running an end-to-end malicious residential proxy operation since at least 2022, using trojanized software installers and more than **230 lookalike domains** to turn victim devices into proxy nodes. The campaign used counterfeit installers and fake review sites impersonating trusted software and services, including **7-Zip**, **WhatsApp**, **TikTok**, YouTube downloader tools, and a fake **WireVPN** brand, with one notable lure hosted on `7zip[.]com`. Investigators linked the activity through shared domain records, backend infrastructure, code overlaps, and a hardcoded **IPLogger** beacon, concluding that the operators both infected victims and resold their bandwidth as residential proxy access. The operation expanded across **Windows, macOS, and Android**, and the WireVPN-branded Android app reportedly exceeded **1 million downloads**, while exhibiting behavior consistent with proxy exit-node abuse rather than legitimate VPN protection. WHOIS and infrastructure analysis indicate the operation is likely run by a **China-based** actor.
Jul 10, 2026
Researchers reported multiple campaigns using spoofed download and streaming sites to trick users into installing remote access tools, unwanted applications, and proxyware. Kaspersky found more than 90 fake software domains in 10 languages distributing trojanized Windows downloads that silently installed **ScreenConnect** via DLL sideloading and then deployed **AsyncRAT** for persistent access; in one case, the attackers altered Windows Defender exclusions, disabled **UAC**, and used process hollowing into `RegAsm.exe`. Separately, Gurucul identified a large network of pirated sports-streaming sites exploiting interest in the FIFA World Cup, using mirror domains, typosquatting, cloud-hosted pages, and rotating infrastructure to push fake **Stremio** installers, VPN-themed lures, phishing pages, scams, and unwanted software. Infoblox tied a fake `7zip[.]com` installer campaign to a broader residential proxy operation tracked as **Lurking Lizard**, linking more than 230 domains involved in fake downloads, fake review sites, proxy storefronts, and **WireVPN**-branded applications that appear to enroll devices into a distributed proxy network. The wider proxyware ecosystem is affecting enterprise and consumer environments alike: Infoblox said 65% of its Threat Defense Cloud customers generated DNS queries in 2026 to domains associated with residential proxy activity, totaling more than 500 billion queries per month, underscoring how free VPNs, streaming apps, browser extensions, and low-cost connected devices are being abused to hijack residential IP space for fraud, scraping, account abuse, and regional restriction bypass.
Jul 7, 2026