Lurking Lizard Used Fake Installers and VPN Apps to Build a Malicious Proxy Network
Summary
Researchers linked more than 230 domains and multiple campaigns dating to 2022 to Lurking Lizard, which uses trojanized software and VPN-branded apps to recruit devices as residential proxy nodes.
Key points
- The fake 7-Zip installer hosted at 7zip[.]com enrolled victims’ devices as proxy nodes; the legitimate 7-Zip site is 7-zip[.]org.
- DNS, registration data, malware samples and shared infrastructure linked more than 230 domains and activity dating to at least August 2022.
- A hardcoded IPLogger URL served as a telemetry beacon and helped researchers connect campaigns involving fake downloaders, VPNs and other lures.
- Recent WireVPN-branded Windows samples share code and behaviors with earlier payloads, including persistence changes and firewall rules created with netsh.
- Network observations suggest WireVPN may use infected systems as exit nodes for third-party traffic rather than operating as a conventional VPN; further analysis is needed.
- WireVPN apps were listed across Windows, iOS and Android. The Android listing reported more than one million downloads, though researchers could not verify usage or analyze the mobile apps’ functionality.
Article Details
- Attack Vectors
- Trojanized installers impersonating 7-Zip and other software recruit victim devices as residential proxy nodes.
- Lookalike domains and mobile applications using WireVPN branding provide additional potential victim-acquisition channels; the role of the mobile applications was not analyzed.
- Payloads request a hardcoded IPLogger URL to collect visitor metadata, including the visitor's IP address and device and browser details.
- WireVPN samples create firewall rules allowing their binaries to communicate externally and make multiple concurrent connections to actor-controlled hosts. The researchers assess that affected systems may function as proxy exit nodes, while noting that further analysis is needed.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | 7zip[.]com | Actor-controlled lookalike domain used to distribute the fake 7-Zip installer. |
| DOMAIN | 911proxy[.]com | Proxy-service domain identified in a third-party assessment as one of Lurking Lizard's services. |
| DOMAIN | bintangwarisanhotel[.]com | Domain assessed as actor-controlled and linked to the fake 7-Zip infrastructure. |
| DOMAIN | ipidea[.]org | Lookalike domain attributed to Lurking Lizard and impersonating IPIDEA. |
| DOMAIN | proxyreviews[.]org | Domain associated with an apparent actor-operated proxy-service review site. |
| DOMAIN | smartproxy[.]org | Actor-controlled domain impersonating Smartproxy and offering proxy access. |
| DOMAIN | wirevpn[.]app | Domain associated with the actor-controlled WireVPN-branded infrastructure. |
| DOMAIN | wirevpn[.]cc | Domain used by newer WireVPN samples to communicate with actor-controlled infrastructure. |
| DOMAIN | wirevpn[.]io | Domain associated with the actor-controlled WireVPN-branded infrastructure. |
| HOSTNAME | abc[.]breakoursilence[.]com | Benign-looking host contacted by WireVPN samples; the article identifies it as actor-controlled. |
| HOSTNAME | api[.]betflixfree[.]net | Host associated with the activity that exposed APIs matching the actor-linked infrastructure. |
| HOSTNAME | api[.]isharkvpn[.]com | Host associated with the activity that exposed APIs matching the actor-linked infrastructure. |
| HOSTNAME | api[.]snaptik[.]io | Host associated with the activity that exposed APIs matching the actor-linked infrastructure. |
| HOSTNAME | api[.]wirevpn[.]app | WireVPN-associated API host exposing endpoints linked to the shared infrastructure. |
| HOSTNAME | api[.]wirevpn[.]io | WireVPN-associated API host exposing endpoints linked to the shared infrastructure. |
| HOSTNAME | bin[.]visitbenin[.]org | Benign-looking host contacted by WireVPN samples; the article identifies it as actor-controlled. |
| HOSTNAME | cate[.]norton-com-nu16[.]com | Benign-looking host contacted by WireVPN samples; the article identifies it as actor-controlled. |
| HOSTNAME | update[.]whtatsapp[.]net | WhatsApp-lookalike update host associated with the actor's lure infrastructure. |
| HOSTNAME | update[.]wirevpn[.]app | WireVPN-related update host identified as part of the actor's infrastructure. |
| URL | hxxps[:]//iplogger[.]com/mnWD | Hardcoded telemetry beacon requested by the payloads to collect visitor metadata and link campaigns. |
MITRE ATT&CK
People
Threat Actors
Products
7-ZipOur discovery started with a single campaign: In early 2026, the actor, who we track as Lurking Lizard, fooled users into downloading a fake version of the 7-Zip archive utility.911ProxyLurking Lizard even impersonates proxy services, including IPIDEA, SmartProxy, IP Royal, and 911Proxy.HeroSMSLookalike domains not only impersonate popular software like 7-Zip, but also several popular VPNs and services like HeroSMS, which provide access to banks of virtual phone numbers.IP RoyalLurking Lizard even impersonates proxy services, including IPIDEA, SmartProxy, IP Royal, and 911Proxy.IPIDEALurking Lizard even impersonates proxy services, including IPIDEA, SmartProxy, IP Royal, and 911Proxy.Kookeeyand smartproxy[.]org combine their own pool of compromised devices with a larger upstream provider like Kookeey or IPIDEA.SmartProxyLurking Lizard even impersonates proxy services, including IPIDEA, SmartProxy, IP Royal, and 911Proxy.WireVPNA hardcoded IPLogger URL embedded within multiple samples enabled us to link otherwise distinct campaigns and payloads across several years, including video downloader malware and more recent WireVPN-themed variants.
Tools
IPLoggerA hardcoded IPLogger URL embedded within multiple samples enabled us to link otherwise distinct campaigns and payloads across several years, including video downloader malware and more recent WireVPN-themed variants.netshIn each case, the Windows command-line networking utility “netsh” is used to create explicit firewall rules allowing their respective binaries (such as “hero” and “wire”) to communicate with the internet unimpeded.