Fake 7-Zip Installers Turn Devices Into Residential Proxy Nodes
Fake 7-Zip installers are used by Lurking Lizard to turn devices into proxy nodes.
A threat actor known as Lurking Lizard is operating a malicious residential proxy business, leveraging over 230 lookalike domains and a technique called drop-catching to acquire expired domains. They distribute malware disguised as legitimate software, such as 7-Zip installers and VPN applications, to recruit victim devices into a proxy botnet. This infrastructure is then monetized by impersonating legitimate proxy providers and running fake review sites to drive traffic to their own services.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google?
Get an email when a new story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Lurking Lizard threat actor exploits users' trust in recognizable software brands like 7-Zip by distributing malware through convincing lookalike domains, including expired domains acquired via drop-catching. Victims unknowingly install malicious installers that silently enroll their devices into a residential proxy botnet, which is then monetized by impersonating legitimate proxy services. This attack succeeds primarily because users fail to verify the authenticity of software sources before downloading and executing installers. The scale of over 230 lookalike domains demonstrates how low-cost infrastructure can support a large-scale, persistent threat operation. Organizations and individuals who do not validate software integrity or restrict download sources remain highly exposed to this class of supply chain and social engineering attack.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — 7zip[.]com
- malware — wirevpn - Fast Unlimited Proxy