Home / Technology / Hackers Hijack Internet with Legitimate Software
Hackers Hijack Internet with Legitimate Software
16 Oct
Summary
- Attackers installed legitimate bandwidth-sharing software.
- Compromised devices were added to anonymous proxy networks.
- At least 143 devices across 34 countries were affected.
A novel proxyjacking campaign has been uncovered, where threat actors are leveraging legitimate software to hijack internet connections. Instead of deploying malware, attackers exploit vulnerabilities in network-attached devices to install applications like Pawns.app, which enables bandwidth sharing. This allows compromised devices to be integrated into proxy networks, masking illicit online activities.
The campaign has so far affected a minimum of 143 devices situated in 34 different countries. Vulnerabilities in D-Link ShareCenter NAS devices, Ubiquiti UniFi Video NVRs, and SAP NetWeaver Visual Composers were specifically targeted. This widespread compromise underscores critical security lapses in device patching and access control mechanisms globally.
While the Pawns.app bandwidth-sharing feature was officially discontinued as of 2026, older versions apparently still function. This ongoing exploitation highlights the risks associated with unauthorized use of personal internet bandwidth for criminal purposes. GreyNoise, the security firm that identified the campaign, offers a free service for IP address checks as a potential indicator of proxyjacking.
