A proxyjacking campaign has impacted devices in 34 countries, monetizing victims’ internet connections through a commercial residential proxy network by installing Pawns.app on devices without the owners’ consent, according to a recent report by Bleeping Computer.
The campaign, discovered by GreyNoise, targeted edge devices across 34 countries, compromising at least 143 devices. Attackers exploited several vulnerabilities, including CVE-2024-3272 and CVE-2024-3273 in D-Link ShareCenter NAS, CVE-2021-44228 in Ubiquiti UniFi Video NVR, and CVE-2025-31324 in SAP NetWeaver Visual Composer. Hikvision and Dahua DVR/NVR devices were also targeted. The attackers installed Pawns.app, a legitimate bandwidth-sharing application, on compromised systems to route traffic and earn payouts. This practice can lead to IP address blocks for users and potential accusations of involvement in illegal activities, as the FBI has previously warned about residential proxies being used in credential stuffing attacks. To mitigate risks, users should avoid untrusted software sources and keep internet-facing systems like NAS devices and video recorders updated with strong credentials and secure configurations.
Source: Bleeping Computer
