Proxyjacking Campaign Uses Legitimate App to Hijack 143 Devices Across 34 Countries

Proxyjacking is an attack in which a device is hijacked and assimilated into a proxy network. Threat actors need clean, unflagged devices and IP addresses to hide behind, making residential proxies valuable. Usually, cybercriminals would break into a computer, install malware and build a proxy network they can rent or use themselves. Malicious residential proxies are difficult to sustain because the malware used to recruit devices can be flagged and quarantined by antivirus products. In this campaign, the researchers found someone installing Pawns.app, primarily a rewards platform that lets users earn money by completing online surveys and playing games. The app used to offer a bandwidth-sharing feature that let users earn money by allowing business clients to route their internet traffic through the user’s residential IP address. At the start of the year, the app discontinued the feature, but it appeared to still work for older versions. “As of 2026, Pawns.app does not offer internet bandwidth sharing,” a notification on the app’s website says. “This feature was discontinued and is not associated with Pawns.app anymore.” The app’s terms of use still describe traffic sharing as available in some versions, and its business website still promotes an SDK for bandwidth monetization.

GreyNoise said the attackers targeted D-Link ShareCenter NAS devices, Ubiquiti UniFi Video NVRs and SAP NetWeaver Visual Composers. The campaign leveraged CVE-2024-3272 and CVE-2024-3273 for D-Link, CVE-2021-44228 for Ubiquiti and CVE-2025-31324 for SAP to deploy Pawns.app. The researchers also said Hikvision and Dahua DVR/NVR devices were targeted, but they did not say which vulnerabilities were used against those products.

At the time of publication, GreyNoise had identified at least 143 compromised devices worldwide, located in 34 different countries. Although the software installed on them was legitimate, it was deployed without the device owners’ knowledge or consent, making the operation illegal. “While ‘earn on your internet’ is voluntary, proxyjacking is a crime. Proxyjacking is when an MCA (malicious cyber actor) forces victim devices into proxy networks in order to monetize their bandwidth,” GreyNoise warned.

Some of the largest malicious residential proxy services, including IPIDEA, NetNut and Cloudrouter, have been dismantled or severely disrupted, but while they were operational they offered hundreds of thousands, sometimes millions, of IP addresses associated with household internet connections. The latest campaign avoided the malware problem by using software that was already available and legitimate.

GreyNoise created a free service that lets users check whether their IP interacted with its Global Observation Grid, which the researchers said can serve as a potential indicator of proxyjacking. It recommended that businesses scan IP addresses, educate employees about the risks of installing free apps and keep devices patched. It also advised detecting residential proxy IP addresses in authentication logs and watching for deviations in user authentication behavior and characteristics beyond geolocation, such as mismatches in device identifiers or session identifiers.