D-Link, Ubiquiti devices hijacked by hackers to plunder stolen bandwidth

Attackers exploited vulnerable devices to install legitimate bandwidth-sharing software and hijack internet connections Compromised systems were covertly added to proxy networks, enabling anonymous criminal activity Campaign affected at least 143 devices across 34 countries, highlighting patching and access-control failures When threat actors break into a system, they don’t need to install malware to make use of the compromised endpoint - they can install perfectly legal, normal software, and still walk away with a paycheck they didn’t earn.

A recent proxyjacking campaign spotted by security researchers GreyNoise impacted hundreds of devices in dozens of countries.

Proxyjacking Proxyjacking is a type of attack in which a device is hijacked and assimilated into a proxy network.

Usually, cybercriminals would break into a computer, install malware and create a proxy network of their own, which they can later rent or use themselves.

Threat actors are always in need of “clean” and unflagged devices and IP addresses behind which they can hide, making residential proxies - both malicious and legal - highly wanted services.

Some of the biggest malicious residential proxies out there include IPIDEA, NetNut, and Cloudrouter.

All of them are now either entirely dismantled, or severely disrupted, but while they were operational, they offered hundreds of thousands (sometimes millions) of IP addresses associated with an internet connection used in a household (hence the name “residential IP address”).

But malicious proxies are difficult to pull off.

To assimilate a device into the network, the threat actor needs to deploy malware which, as soon as it’s spotted, will be flagged by antivirus products and quarantined.

In the newest attacks, spotted by GreyNoise, someone went for a legitimate app with similar functionality, instead.

The researchers found someone installing Pawns.app, primarily a rewards platform that lets users earn money by completing online surveys and playing games.

However, it used to offer a bandwidth-sharing feature that let users earn money by allowing business clients to route their internet traffic through the user’s residential IP address.

At the start of the year, the app discontinued the feature, but it seems it still works for older versions.

“As of 2026, Pawns.app does not offer internet bandwidth sharing,” a notification on the app’s website reads.