A proxyjacking campaign has impacted devices in 34 countries, monetizing victims’ internet connections through a commercial residential proxy network.
The operator installed Pawns.app, a legitimate bandwidth-sharing application that lets users earn money by sharing their internet connections, on devices without the owners’ consent.
Pawns.app account holders are rewarded for allowing traffic from other users to flow through their network, provided it runs on trusted, non-blocking IP addresses.
By installing the app on multiple systems, the attacker likely accumulated larger payouts.
Threat intelligence company GreyNoise discovered the campaign while investigating suspicious activity at an unnamed organization, and identified at least 143 compromised devices worldwide.
According to the researchers, the attacker leveraged several vulnerabilities to breach edge devices and install the Pawns.app software:
- CVE-2024-3272 and CVE-2024-3273 in D-Link ShareCenter NAS
- CVE-2021-44228 in Ubiquiti UniFi Video NVR
- CVE-2025-31324 in SAP NetWeaver Visual Composer
The researchers also observed targeting of Hikvision and Dahua DVR/NVR devices, but did not specify the vulnerabilities exploited in these systems.
GreyNoise says that, in some cases, the attackers configured SSH key authentication as a backup access method.
Even legitimate proxy networks can route suspicious traffic through volunteer-operated nodes due to insufficient oversight, potentially resulting in IP address blocks for participating users or exposing them to allegations of involvement in illegal activities.
The FBI previously warned about such networks being used to carry out large-scale credential stuffing attacks against online platforms.
GreyNoise provides a free service (account required) for users to check if their IP address is part of a known legitimate or “gray” proxying service.
It is generally advisable to avoid downloading software from untrusted sources, as purportedly free software may contain malware that enrolls devices in residential proxy networks.
Threat actors also commonly exploit known vulnerabilities in internet-connected devices. Keeping NAS devices, video recorders, and other internet-facing systems updated can significantly reduce the risk of compromise.
However, users should also use strong credentials, a secure configuration, and restrict network access.
Build your security blueprint for AI-powered attacks
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
Save your seat