A proxyjacking campaign has impacted devices in 34 countries, monetizing victims’ internet connections through a commercial residential proxy network.
The operator installed Pawns.app, a legitimate bandwidth-sharing application that lets users earn money by sharing their internet connections, on devices without the owners’ consent.
Pawns.app account holders are rewarded for allowing traffic from other users to flow through their network, provided it runs on trusted, non-blocking IP addresses.
By installing the app on multiple systems, the attacker likely accumulated larger payouts.
.jpg)
Threat intelligence company GreyNoise discovered the campaign while investigating suspicious activity at an unnamed organization, and identified at least 143 compromised devices worldwide.
According to the researchers, the attacker leveraged several vulnerabilities to breach edge devices and install the Pawns.app software:
- CVE-2024-3272 and CVE-2024-3273 in D-Link ShareCenter NAS
- CVE-2021-44228 in Ubiquiti UniFi Video NVR
- CVE-2025-31324 in SAP NetWeaver Visual Composer
The researchers also observed targeting of Hikvision and Dahua DVR/NVR devices, but did not specify the vulnerabilities exploited in these systems.
GreyNoise says that, in some cases, the attackers configured SSH key authentication as a backup access method.
Source: GreyNoise
Even legitimate proxy networks can route suspicious traffic through volunteer-operated nodes due to insufficient oversight, potentially resulting in IP address blocks for participating users or exposing them to allegations of involvement in illegal activities.
The FBI previously warned about such networks being used to carry out large-scale credential stuffing attacks against online platforms.
GreyNoise provides a free service (account required) for users to check if their IP address is part of a known legitimate or “gray” proxying service.
It is generally advisable to avoid downloading software from untrusted sources, as purportedly free software may contain malware that enrolls devices in residential proxy networks.
Threat actors also commonly exploit known vulnerabilities in internet-connected devices. Keeping NAS devices, video recorders, and other internet-facing systems updated can significantly reduce the risk of compromise.
However, users should also use strong credentials, a secure configuration, and restrict network access.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
