What is proxyjacking and why should you care?
Proxyjacking is an emerging cyber attack method where hackers take control of internet-connected devices to funnel traffic through them without owners' consent. Rather than using traditional malware that is easily detected, attackers often deploy legitimate software designed for bandwidth sharing, enabling them to covertly rent out these hijacked connections. This provides cybercriminals with "clean" IP addresses to hide behind, facilitating activities like anonymous browsing, spam campaigns, or unauthorized access to services.
Which devices are most vulnerable and how are they exploited?
Many commonly used network-attached devices, such as certain models of D-Link NAS servers, Ubiquiti video recorders, and other IP-connected hardware, contain unpatched security vulnerabilities. Threat actors exploit flaws (such as CVE-2024-3272, CVE-2024-3273 for D-Link and CVE-2021-44228 for Ubiquiti devices) to quietly install legitimate apps like Pawns.app. Although these apps originally offered user-consented bandwidth sharing, outdated versions still enable unauthorized use, effectively turning infected devices into stealth proxy nodes. The attack campaign has affected at least 143 devices across 34 countries, underscoring the global scale and impact of poor patch management and weak access controls.
What risks do proxyjacked devices pose to users and organizations?
Aside from wasting your internet bandwidth and potentially slowing your network, hijacked devices become anonymity shields for criminals. This can implicate owners in illicit activities while obscuring true perpetrators. Moreover, devices running unauthorized bandwidth-sharing software without consent violate privacy and security policies. Businesses face an elevated risk of internal credential compromise because proxy networks complicate authentication monitoring, especially if residential IP addresses are involved. Attackers can also leverage such networks to bypass geo-restrictions or evade security systems.
How can individuals and businesses detect and prevent proxyjacking?
Devices should be regularly patched with the latest security updates to close known vulnerabilities. Avoid installing unverified software, especially free apps promising earnings from bandwidth sharing. Network administrators can monitor authentication logs for unusual residential proxy IPs and irregular session behaviors, such as mismatched device or session identifiers. Public tools are available to check if an IP address has interacted with proxyjacking networks, providing an early warning. Employee education on cybersecurity hygiene remains critical to reducing risk exposure.
Key takeaway for device owners and network managers
Proxyjacking illustrates how attackers can repurpose legitimate software to monetize stolen bandwidth, bypassing traditional malware detection. Protecting network-connected devices demands diligent patching, controlled software installation, and vigilant monitoring of network activity. Users should be aware of the risks posed by latent vulnerabilities in common IoT and networking gear and take proactive measures to secure their digital environments and prevent illegal exploitation.