Lurking Lizard uses fake 7-Zip installers to recruit residential proxy nodes

Intelligence Summary

Lurking Lizard is running an end-to-end malicious residential proxy service. The campaign uses more than 230 lookalike domains to deliver the payload. Victims are pulled in through fake 7-Zip installers that trick users into installing attacker-controlled software. Once compromised, devices can be used as residential proxy nodes for further abuse. This increases anonymity for malicious traffic and makes the proxy infrastructure harder to block. Users should avoid untrusted 7-Zip downloads and verify software sources before installing.

Recommended Action

Review affected assets, schedule urgent remediation, and monitor related indicators.

Topics