Fake 7-Zip Installers Turn Devices Into Residential Proxy Nodes

1. Executive summary

Infoblox has disclosed a threat actor dubbed "Lurking Lizard" operating an end-to-end malicious residential proxy business using trojanized installers — including a fake 7-Zip installer hosted on 7zip[.]com — to covertly recruit victim devices as proxy nodes. Attribution to a China-based actor is unconfirmed: "Lurking Lizard" has no MITRE ATT&CK profile, and the assessment rests on WHOIS analysis and infrastructure fingerprinting from a single vendor (Infoblox). The campaign dates to at least August 2022 and uses more than 230 lookalike domains, impersonating major proxy providers (IPIDEA, SmartProxy/Decodo, IP Royal, 911Proxy) and distributing lures for 7-Zip, WhatsApp, TikTok/YouTube downloaders, and WireVPN. For EMEA financial services, the primary risk is corporate endpoints being silently enrolled as proxy exit nodes, exposing the organisation's IP space to third-party criminal traffic and potential reputational and legal liability.

2. Regulatory framing

3. Technical analysis & attack chain

Confirmed attack chain

1. Domain acquisition and infrastructure setup. The actor uses "drop-catching" — acquiring expired domains to inherit their accumulated history and legitimacy. The actor has registered 230+ lookalike domains impersonating legitimate proxy providers and software projects. In some cases, the actor exploits incorrectly referenced domain names (e.g., victims typing "7zip[.]com" instead of the official "7-zip[.]org").
2. Victim acquisition. Victims are directed to malicious installers through three channels: tutorial content, search-driven discovery, and lookalike domains. Fake "independent" review sites drive traffic to the actor's scam storefronts.
3. Trojanized installer delivery. The 7-Zip campaign delivered a trojanized 7-Zip installer from "7zip[.]com." Additional lures served from the same infrastructure include fake installers for WhatsApp, tools falsely claiming to be TikTok and YouTube downloaders, and WireVPN.
4. IPLogger beacon. Samples tied to the 7-Zip campaign contain an embedded IPLogger URL: iplogger[.]com/mnWD. This URL links the 7-Zip campaign to the broader infrastructure serving all the above-mentioned lures.
5. Proxy node enrolment. Compromised desktop devices are converted into proxy exit nodes that funnel third-party traffic through victims' devices. The actor then monetizes the proxy pool through lookalike proxy service brands.
6. Monetization. The proxy pool is sold through lookalike brands impersonating IPIDEA, SmartProxy (now Decodo), IP Royal, and 911Proxy. Proxyway found 773,087 unique IP addresses linked to SmartProxy also present in a publicly available IPIDEA IP dataset of 16,192,293 unique IPs, suggesting SmartProxy either resells IPIDEA's infrastructure or uses it as a significant IP source.
7. Mobile expansion. The WireVPN branding represents the latest evolution, targeting Android, macOS, and Windows. An Android app called "wirevpn - Fast Unlimited Proxy," developed by UK-based "WEILAI NETWORK TECHNOLOGY CO., LIMITED," has amassed 1M+ downloads. It is unclear whether these downloads are organic, and it is unclear whether the same proxy exit-node functionality is present in the mobile applications or limited to desktop.

Attribution caveat: "Lurking Lizard" has no MITRE ATT&CK profile; attribution is unconfirmed. The China-based assessment rests on WHOIS analysis and infrastructure fingerprinting from Infoblox alone — single-sourced; verify before enforcement.

Technical gaps in source material: The source does not provide specific malware family names, file hashes, C2 protocols, persistence mechanisms, registry keys, file paths beyond the installer domain, or command-line artefacts. The exact mechanism by which the trojanized installer enrols devices as proxy nodes is not described. No CVE is referenced.

4. Mitigation & containment

P1 — Within 24 hours

• Block known malicious domains at DNS resolver and web proxy: 7zip[.]com, iplogger[.]com (or specifically the path iplogger[.]com/mnWD). Note: iplogger[.]com is a legitimate IP-logging service abused as infrastructure; consider blocking the specific URL path rather than the entire domain if business use exists.
• Block the Android application "wirevpn - Fast Unlimited Proxy" (developer: WEILAI NETWORK TECHNOLOGY CO., LIMITED) on all MDM-enrolled devices.
• Search endpoint telemetry for historical connections to 7zip[.]com and iplogger[.]com/mnWD (last 12 months minimum, given campaign dates to August 2022).
• Alert on outbound proxy traffic from workstations that should not be running proxy services — unexpected listening ports, unusual outbound connection patterns consistent with proxy relay.

P2 — Within 72 hours

• Application allow-listing / software download policy: Block user-initiated downloads of executable installers from non-approved domains. Ensure the official 7-Zip domain is documented as 7-zip[.]org in user guidance and IT documentation.
• Review DNS logs for any of the 230+ lookalike domains. The source does not enumerate them all; request the full list from Infoblox if available, or hunt for domains impersonating: IPIDEA, SmartProxy, Decodo, IP Royal, 911Proxy, WireVPN.
• EDR hunt: Search for processes named or matching wirevpn, and any 7-Zip installer binaries not signed by the legitimate 7-Zip publisher or downloaded from 7-zip[.]org.
• Network egress review: Identify any internal IPs appearing in residential proxy datasets. Cross-reference against known proxy IP feeds.

P3 — Within 7 days

• User awareness: Brief staff on the typosquatting vector (7zip[.]com vs. 7-zip[.]org) and the broader pattern of trojanized installers promoted through tutorial content and search results.
• Software sourcing controls: Update software procurement and download procedures to require verification of publisher domains. Add the drop-catching technique to threat-modelling for software supply chain.
• Mobile app governance: Review the mobile application allow-list and block apps from developer "WEILAI NETWORK TECHNOLOGY CO., LIMITED" pending verification.

5. Indicators of compromise

domain  7zip[.]com
url  iplogger[.]com/mnWD
domain  7-zip[.]org
android-app  wirevpn - Fast Unlimited Proxy
developer-name  WEILAI NETWORK TECHNOLOGY CO., LIMITED

6. Detection

rule Lurking_Lizard_7zip_Installer_Campaign {
    meta:
        author = "Adverse Trace"
        date = "2026-07-09"
        reference = "https://thehackernews.com/2026/07/fake-7-zip-installers-turn-devices-into.html"
        description = "Detects artefacts associated with Lurking Lizard trojanized 7-Zip installer campaign"
    strings:
        $domain1 = "7zip.com" nocase
        $domain2 = "iplogger.com/mnWD" nocase
        $app1 = "wirevpn" nocase
        $dev1 = "WEILAI NETWORK TECHNOLOGY CO., LIMITED" nocase
    condition:
        2 of them
}

title: Lurking Lizard Proxy Campaign - Network Connections to Known Malicious Infrastructure
id: 7a3c1f2e-9b4d-4a8c-9e1f-0a2b3c4d5e6f
status: experimental
description: Detects network connections to domains and URLs associated with the Lurking Lizard residential proxy campaign
references:

    - https://thehackernews.com/2026/07/fake-7-zip-installers-turn-devices-into.html
author: Adverse Trace
date: 2026/07/09
logsource:
    category: network_connection
    product: any
detection:
    selection:
        DestinationHostname|endswith:

            - "7zip.com"
        DestinationHostname|contains:

            - "iplogger.com"
    selection_url:
        DestinationUrl|contains:

            - "iplogger.com/mnWD"
    condition: selection or selection_url
falsepositives:

    - iplogger.com is a legitimate IP-logging service; consider scoping to the specific URL path
level: high

title: Lurking Lizard - WireVPN Android Application Installed
id: 8b4d2g3f-0c5e-5b9d-af2g-1b3c4d5e6f7a
status: experimental
description: Detects installation of the WireVPN application associated with the Lurking Lizard proxy campaign
references:

    - https://thehackernews.com/2026/07/fake-7-zip-installers-turn-devices-into.html
author: Adverse Trace
date: 2026/07/09
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:

            - "wirevpn"
    condition: selection
falsepositives:

    - Legitimate VPN client with similar name (unlikely)
level: high

7. Sources

• The Hacker News, "Fake 7-Zip Installers Turn Devices Into Residential Proxy Nodes," https://thehackernews.com/2026/07/fake-7-zip-installers-turn-devices-into.html, 2026-07-09
• Infoblox (cited via The Hacker News), DNS threat intelligence findings on Lurking Lizard, https://thehackernews.com/2026/07/fake-7-zip-installers-turn-devices-into.html
• Proxyway (cited via The Hacker News), findings on SmartProxy/IPIDEA IP overlap, https://thehackernews.com/2026/07/fake-7-zip-installers-turn-devices-into.html

8. Adverse Trace position

This is a medium-severity advisory for EMEA financial services. No CVE is in scope and no CISA-KEV exploitation is referenced. The core risk is not direct data theft or ransomware but silent enrolment of corporate endpoints as residential proxy exit nodes — exposing the organisation's IP addresses to third-party criminal traffic, with attendant reputational, legal, and potential regulatory consequences. Attribution to "Lurking Lizard" as a China-based actor is unconfirmed (no MITRE ATT&CK profile; single-sourced to Infoblox WHOIS and infrastructure fingerprinting). The campaign's longevity (since August 2022), scale (230+ domains, 16M+ IPs in the proxy pool), and use of drop-catching and lookalike domains indicate a mature, well-resourced operation. We are treating the IOCs as actionable but note the full domain list is not publicly enumerated in the source — clients should request it directly from Infoblox. Adverse Trace will update this advisory if additional IOCs, malware family details, or the full lookalike domain list become available.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.