Fake 7-Zip installers power a hidden residential proxy network, Infoblox finds
Threat intelligence firm Infoblox uncovered a residential proxy operation, dubbed Lurking Lizard, that lured victims with trojanized 7-Zip installers across more than 230 lookalike domains. The scheme has resurfaced as a VPN app with over a million Android downloads.
Security researchers at Infoblox have exposed a large residential proxy operation they call Lurking Lizard. Victims were lured with a fake, trojanized 7-Zip installer hosted on a lookalike domain, which quietly turned their devices into proxy nodes rented out to others. Infoblox mapped more than 230 lookalike domains tied to the operation, which impersonated legitimate proxy providers and even ran fake independent review sites to appear trustworthy. The activity, likely tied to a China-based actor, has resurfaced as a VPN app reported to exceed one million downloads on Android. The takeaway for users: download tools only from official sources. Source: Infoblox, The Hacker News. Visuals are AI-generated.