Proxyjacking campaign hijacks D-Link and Ubiquiti devices in 34 countries

A proxyjacking campaign has compromised at least 143 devices across 34 countries, using victims’ internet connections through a commercial residential proxy network, according to threat intelligence company GreyNoise.

The operator installed Pawns.app, a legitimate bandwidth-sharing application, on devices without their owners’ consent. The app lets account holders earn money by allowing other users’ traffic to pass through their internet connections, provided the IP addresses are trusted and do not block that traffic. Installing it on multiple systems likely helped the attacker increase payouts, GreyNoise said.

GreyNoise found the campaign while investigating suspicious activity at an unnamed organization. Researchers said the attacker exploited several vulnerabilities to breach D-Link and Ubiquiti edge devices and install the app. They also saw attempts to target Hikvision and Dahua DVR/NVR devices, but did not identify the vulnerabilities used against those systems. In some cases, attackers set up SSH key authentication as a backup way to access devices.

Even legitimate proxy networks can route suspicious traffic through volunteer-operated nodes when oversight is limited. That could lead to participating users’ IP addresses being blocked or expose them to allegations of involvement in illegal activity. The FBI has previously warned that such networks have been used in large-scale credential stuffing attacks.