Lurking Lizard trojanized 7-Zip installer campaign
Campaign
Summary
Hide ▲
Show ▼
A Lurking Lizard campaign used a trojanized 7-Zip installer to recruit devices as proxy nodes, expanding a residential-proxy operation that has run since at least August 2022. The lure exposed users on Android, macOS, and Windows to proxy malware and funneled compromised systems into the actor’s infrastructure. The same operation also used lookalike domains and fake review sites to direct traffic toward its storefronts.
Timeline
-
09.07.2026 07:01 1 articles · 19h ago
Lurking Lizard residential proxy operation uses trojanized 7-Zip installers
Initial DisclosureCybersecurity researchers disclosed a Lurking Lizard residential proxy operation that has run since at least August 2022, using more than 230 lookalike domains and trojanized 7-Zip installers on 7zip[.]com to recruit compromised devices as proxy nodes. The same infrastructure also impersonates IPIDEA, SmartProxy (now Decodo), IP Royal, 911Proxy, and WireVPN, and uses fake review sites and wrong-domain lookalikes to drive traffic to scam storefronts.
Show sources
- Fake 7-Zip Installers Turn Devices Into Residential Proxy Nodes — thehackernews.com — 09.07.2026 07:01