Download 7-Zip from the wrong site and your computer becomes a pawn in a proxy scheme. Researchers at Infoblox uncovered a threat actor dubbed Lurking Lizard running a residential proxy business using more than 230 lookalike domains.
The operation dates back to at least August 2022. Earlier this year, they lured victims with a trojanized 7-Zip installer hosted on “7zip[.]com” — that’s one dash short of the real 7-zip[.]org. Once installed, the malware quietly turns the victim’s machine into a proxy exit node.
Lurking Lizard doesn’t stop at fake installers. They impersonate major proxy providers including IPIDEA, SmartProxy (now Decodo), IP Royal, and 911Proxy. They even run fake “independent” review sites to drive traffic to their scams.
Interestingly, Google dismantled IPIDEA’s infrastructure in January. But the ecosystem didn’t die — it just shifted. Proxyway found that 773,087 unique IPs linked to SmartProxy overlapped with a public IPIDEA dataset of 16 million IPs. SmartProxy may be reselling the same infrastructure.
WHOIS analysis suggests Lurking Lizard operates out of China. They use a technique called drop-catching — acquiring expired domains to inherit their legitimacy. Beyond 7-Zip, they’ve pushed fake installers for WhatsApp, TikTok downloaders, YouTube downloaders, and WireVPN.
The WireVPN Android app — “wirevpn – Fast Unlimited Proxy” — has over a million downloads on Google Play. It’s developed by a UK-registered company called WEILAI NETWORK TECHNOLOGY CO., LIMITED. It’s unclear if the mobile apps include the same proxy functionality, but they may serve as an additional infection channel.
Bottom line: only download software from official sources. That one extra dash in the URL matters.
