# Lurking Lizard's Proxy Network: Fake Services, Real Threats How a threat actor turns devices into proxy nodes through deceptive installers and VPNs. - **Source:** [CyberWire Daily](https://brifing.si/source/08fbf94c-e51b-42cb-be13-84db10e5d993) - **Published:** 2026-09-19 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/4b460e3c-5fa2-4536-8a46-e5e5cb3423eb ## Threat actor uncovered Lurking Lizard, a threat actor active since at least 2022, has been using fake software installers, VPNs, and lookalike domains to covertly turn victims' devices into residential proxy nodes. Infoblox's research links over 230 domains to this operation, revealing a sophisticated infrastructure. The actor's campaigns include fake versions of popular tools like 7-Zip and WireVPN, all connected through shared tracking URLs and APIs. ## Deceptive recruitment tactics The operation recruits compromised devices by disguising malicious installers as legitimate software downloads. Victims unknowingly download these fake installers, which then covertly transform their devices into proxy nodes. This method allows Lurking Lizard to build a distributed network of proxies without the device owners' knowledge or consent. ## Monetization strategy Once devices are compromised, the actor monetizes the hijacked bandwidth through proxy services and fake review sites. The research suggests WireVPN may represent the latest evolution of this campaign, indicating ongoing refinement of their tactics. This end-to-end operation shows a clear profit motive behind the malicious activity. ## Infrastructure connections Researchers connected seemingly separate campaigns by analyzing shared infrastructure elements like tracking URLs, deployment patterns, and APIs. This revealed the coordinated nature of the operation, with different fake services working together to expand the proxy network. The use of lookalike domains adds another layer of deception to the scheme. ## Scale of operation With over 230 identified domains linked to Lurking Lizard, the operation demonstrates significant reach and organization. The actor maintains this extensive network while avoiding detection by distributing their infrastructure across multiple seemingly unrelated services and domains. ## Evolution of tactics The inclusion of WireVPN in the campaign suggests the actor is continuously updating their methods. This adaptability makes the threat more persistent and harder to combat, as security measures must evolve alongside the attacker's techniques. ## Security implications The research highlights how residential proxy networks can be built through covert means, posing risks to both individual device owners and network security overall. Compromised devices become unwitting participants in potentially illegal activities while suffering performance degradation. ## Detection challenges Lurking Lizard's use of legitimate-looking services and distributed infrastructure makes detection difficult. Security teams must look for subtle connections between seemingly unrelated campaigns to uncover such operations, requiring advanced threat intelligence capabilities. ## Sources covering this story - https://thecyberwire.com/podcasts/research-saturday/442/notes — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._