Loading story…
Researchers reported that a threat actor tracked as Lurking Lizard has been running an end-to-end malicious residential proxy operation since at least 2022, using trojanized software installers and more than 230 lookalike domains to turn victim devices into proxy nodes. The campaign used counterfeit installers and fake review sites impersonating trusted software and services, including 7-Zip, WhatsApp, TikTok, YouTube downloader tools, and a fake WireVPN brand, with one notable lure hosted on 7zip[.]com.
Investigators linked the activity through shared domain records, backend infrastructure, code overlaps, and a hardcoded IPLogger beacon, concluding that the operators both infected victims and resold their bandwidth as residential proxy access. The operation expanded across Windows, macOS, and Android, and the WireVPN-branded Android app reportedly exceeded 1 million downloads, while exhibiting behavior consistent with proxy exit-node abuse rather than legitimate VPN protection. WHOIS and infrastructure analysis indicate the operation is likely run by a China-based actor.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
The activity later evolved into a fake VPN brand called WireVPN, distributed through mobile app stores and described as behaving like proxy exit-node abuse rather than legitimate VPN protection. Reporting also says the campaign expanded to target Android, macOS, and Windows users.
The Lurking Lizard operation was reported as having operated since at least August 2022, using fake software installers and related infrastructure to recruit victim devices into a residential proxy network.
Researchers publicly disclosed details tying more than 230 domains, shared backend infrastructure, code overlaps, and a hardcoded IPLogger beacon to Lurking Lizard's end-to-end malicious residential proxy business. The reporting also said WHOIS and infrastructure analysis suggested the operator is based in China.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcethehackernews.com
Open sourcecyberveille.ch
Open sourcecryptika.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported multiple campaigns using spoofed download and streaming sites to trick users into installing remote access tools, unwanted applications, and proxyware. Kaspersky found more than 90 fake software domains in 10 languages distributing trojanized Windows downloads that silently installed **ScreenConnect** via DLL sideloading and then deployed **AsyncRAT** for persistent access; in one case, the attackers altered Windows Defender exclusions, disabled **UAC**, and used process hollowing into `RegAsm.exe`. Separately, Gurucul identified a large network of pirated sports-streaming sites exploiting interest in the FIFA World Cup, using mirror domains, typosquatting, cloud-hosted pages, and rotating infrastructure to push fake **Stremio** installers, VPN-themed lures, phishing pages, scams, and unwanted software. Infoblox tied a fake `7zip[.]com` installer campaign to a broader residential proxy operation tracked as **Lurking Lizard**, linking more than 230 domains involved in fake downloads, fake review sites, proxy storefronts, and **WireVPN**-branded applications that appear to enroll devices into a distributed proxy network. The wider proxyware ecosystem is affecting enterprise and consumer environments alike: Infoblox said 65% of its Threat Defense Cloud customers generated DNS queries in 2026 to domains associated with residential proxy activity, totaling more than 500 billion queries per month, underscoring how free VPNs, streaming apps, browser extensions, and low-cost connected devices are being abused to hijack residential IP space for fraud, scraping, account abuse, and regional restriction bypass.
Jul 7, 2026![Trojanized 7-Zip Installers from 7zip[.]com Used to Deploy Proxyware on Home PCs](/_next/image?url=https%3A%2F%2Fmallory-core-public-images.s3.us-east-2.amazonaws.com%2Ftrojanized-7-zip-installers-from-7zipcom-used-to-deploy-proxyware-on-home-pcs.png&w=3840&q=75)
Malwarebytes reported a malware distribution campaign in which attackers use a lookalike domain, **7zip[.]com**, to impersonate the legitimate 7-Zip download site (*7-zip.org*) and deliver a trojanized installer that still appears to function as expected. The activity surfaced after a Reddit user described being directed to the fake site via a YouTube tutorial/comment, installing the software on multiple systems, and later receiving a generic Microsoft Defender trojan alert; Malwarebytes’ follow-on analysis concluded that systems running installers from **7zip[.]com** should be treated as compromised. Analysis of the counterfeit installer found it drops additional hidden components (including `Uphero.exe`, `hero.exe`, and `hero.dll`) into `C:\Windows\SysWOW64\hero\` and establishes persistence by registering executables as **Windows services** that start with **SYSTEM** privileges. The primary payload was assessed as **proxyware**, turning infected home computers into **residential proxy nodes** that allow third parties to route traffic through victims’ IP addresses; the malware also includes anti-analysis checks to reduce detection. The installer was observed carrying an Authenticode signature issued to **Jozeal Network Technology Co., Limited** (reported as revoked), and defenders were advised to watch for unauthorized services and related network activity, and to block known C2/proxy infrastructure where possible.
Jun 29, 2026
Threat actors are using **software impersonation** and **SEO poisoning** to push victims toward fake download sites for trusted enterprise and IT tools, then delivering malware through trojanized installers. In one campaign, **Storm-2561** used spoofed VPN vendor pages for products such as **Pulse Secure, Fortinet, and Ivanti** to steal enterprise VPN credentials. The malicious packages were hosted on GitHub, signed with a certificate issued to **"Taiyuan Lihua Near Information Technology Co., Ltd."**, and designed to show an error before redirecting victims to the legitimate vendor site, reducing suspicion while exfiltrating credentials. A separate but closely related campaign used fake **FileZilla** download pages to distribute a **Remote Access Trojan** through multi-stage loaders and **DLL sideloading**. Attackers bundled legitimate FileZilla software with a malicious `version.dll`, or dropped the DLL during installation so the malware would execute while the expected application appeared to install normally. Both reports describe the same broader intrusion pattern: adversaries abusing trusted brands, realistic lookalike websites, and legitimate software packaging to compromise users who believe they are downloading authentic tools. A separate **Warlock** intrusion analysis describing web shells, lateral movement, tunneling, and ransomware activity is a different incident and does not match this malware-delivery story.
Jun 29, 2026