The fake 7-Zip installer campaign shows how attackers are turning ordinary user devices into residential proxy nodes through lookalike software-download websites.

Threat actors created fake 7-Zip download pages and distributed trojanized installers that still install the legitimate 7-Zip application to avoid suspicion. Behind the scenes, the installer adds hidden proxy malware that enrolls the infected device into an attacker-controlled proxy network.

Once compromised, the victim’s internet connection can be rented or abused to route malicious traffic, conduct fraud, scan targets, bypass IP reputation controls, or hide the attacker’s real location. The device owner may only notice slower internet, strange connections, or abuse complaints from activity they never initiated.

This campaign is part of a broader operation where infected devices are recruited through fake installers, mobile apps, and deceptive domains, then monetized through lookalike proxy service brands and fake review sites.

Organizations should ensure employees download software only from verified vendor websites or managed internal repositories. Application allowlisting, DNS filtering, web reputation controls, and monitoring for suspicious new services, firewall changes, and unusual outbound proxy traffic can reduce risk.

The key lesson is that a working installer does not prove that the download was safe. Attackers know users relax once the expected application opens, which is charmingly optimistic and exactly what the malware is counting on.

Cybersecurity researchers have disclosed details of a new threat actor dubbed Lurking Lizard that has been operating an end-to-end malicious residential proxy business using an infrastructure comprising more than 230 lookalike domains. The activity dates back to at least August 2022, according to DNS threat intelligence firm Infoblox. Once such campaign, observed earlier this year, involved the

Source: Fake 7-Zip Installers Turn Devices Into Residential Proxy Nodes via The Hacker News — published 09 Jul 2026.