Fake 7-Zip Installers: Lurking Lizard Builds Proxy Botnet

Introduction: Fake 7-Zip Installers — Why It Matters

Cybersecurity researchers have uncovered a sophisticated malware campaign in which Fake 7-Zip Installers 2026 are being used to silently convert victims’ computers into residential proxy nodes. The campaign has been attributed to a China-linked threat actor known as Lurking Lizard, which reportedly operates a large-scale proxy infrastructure by distributing trojanized versions of legitimate software. According to security researchers, the attackers rely on deceptive domains that closely resemble trusted download websites, increasing the likelihood that unsuspecting users will install malicious software.

Unlike traditional malware campaigns focused solely on stealing credentials or encrypting files, Fake 7-Zip Installers are designed to monetize compromised systems by turning them into internet relay points. Once infected, victims’ devices become part of a residential proxy network, allowing cybercriminals and third parties to route their internet traffic through legitimate residential IP addresses. This technique makes malicious activities more difficult to trace while exposing victims to legal, privacy, and security risks.

The campaign extends beyond fake archive software. Researchers report that the same infrastructure has also been used to distribute trojanized versions of applications such as WhatsApp, WireVPN, TikTok Downloader, and YouTube Downloader, suggesting that Lurking Lizard is continuously expanding its infection ecosystem.

What is a Residential Proxy Network?

The Fake 7-Zip Installers 2026 campaign uses a residential proxy network by converting infected devices into internet relay points without users’ knowledge. Because internet traffic appears to originate from ordinary home users, these proxies are often considered more trustworthy than traditional VPN or datacenter proxy services.

Legitimate residential proxy providers obtain user consent before allowing devices to participate in their networks. However, malicious operators build proxy infrastructures by secretly infecting devices with malware, converting them into proxy nodes without the owners’ knowledge.

In this campaign, researchers found that compromised computers are silently enrolled into such a network after users install counterfeit software packages. Once enrolled, attackers can sell proxy access to customers, enabling anonymous browsing, automated account creation, web scraping, advertising fraud, or other potentially malicious online activities. The growing Fake 7-Zip Installers campaign demonstrates how residential proxy malware has become a profitable business model for cybercriminals.

Who is Lurking Lizard?

Lurking Lizard is the name assigned by cybersecurity researchers to a China-linked threat actor believed to be responsible for operating one of the largest malicious residential proxy networks identified in recent months.

Rather than relying on phishing emails or software exploits alone, the group appears to focus heavily on software supply chain deception. Victims are lured into downloading malware from websites that convincingly imitate legitimate software providers.

Researchers observed several notable characteristics of the group’s operations:

• Distribution of trojanized versions of popular software.
• Registration of hundreds of deceptive domains closely resembling legitimate websites.
• Operation of fake software review portals.
• Promotion of fraudulent proxy services.
• Monetization of infected systems through residential proxy subscriptions.

The group’s infrastructure demonstrates a high level of operational planning, allowing the malware campaign to continue scaling while maintaining a relatively low profile.

Fake 7-Zip Installers: Full Technical Breakdown

The campaign follows a carefully structured two-stage infection and monetization model. Instead of immediately stealing information or deploying ransomware, the attackers focus on quietly transforming victim devices into valuable network assets.

After downloading what appears to be a legitimate software installer, victims unknowingly execute malware embedded within the installation package. The malware then establishes persistence on the device before registering it as a residential proxy node.

Researchers identified more than 230 lookalike domains involved in distributing malicious installers. Many of these domains closely imitate trusted software vendors and proxy providers, making them difficult for average users to distinguish from legitimate websites.

Among the brands reportedly impersonated are:

• 7-Zip
• IPIDEA
• SmartProxy (Decodo)
• IP Royal
• 911Proxy

The attackers also employ drop-catching, a technique in which expired domains with established reputations are purchased and reused for malicious purposes. Since these domains may already possess search engine authority and user trust, they are highly effective for malware distribution.

Security researchers further discovered that the malware campaign has expanded beyond fake 7-Zip installers and now targets users searching for:

• WhatsApp installers
• WireVPN
• TikTok Downloader
• YouTube Downloader

One particularly suspicious finding involved a WireVPN Android application that has reportedly accumulated more than one million downloads. Researchers have not confirmed whether these installations represent genuine users or artificially inflated download counts.

Timeline of Events

• Cybersecurity researchers identified a large residential proxy infrastructure linked to the Lurking Lizard threat actor.
• Investigation revealed more than 230 lookalike domains distributing trojanized software.
• Researchers observed fake websites impersonating trusted software providers and residential proxy services.
• The campaign expanded beyond fake 7-Zip installers to include WhatsApp, WireVPN, TikTok Downloader, and YouTube Downloader.
• Analysts identified the use of drop-catching techniques involving expired domains.
• A suspicious WireVPN Android application surpassed one million downloads, though researchers have not confirmed the legitimacy of those installation numbers.
• The discovery follows Google’s recent disruption of the NetNut (Popa) residential proxy botnet, which reportedly compromised more than two million smart TVs and streaming devices, highlighting a broader trend in malicious residential proxy operations.

What Systems Were Potentially Affected?

The campaign appears to target users searching for free or unofficial versions of popular software. Systems potentially affected include:

• Windows computers downloading fake 7-Zip installers.
• Devices installing unofficial WhatsApp applications.
• Systems using counterfeit WireVPN software.
• Users downloading unofficial TikTok Downloader tools.
• Devices installing fake YouTube Downloader applications.
• Computers visiting lookalike software distribution websites.
• Systems downloading software from expired domains repurposed by attackers.

Victims may unknowingly become part of a malicious residential proxy infrastructure without experiencing obvious signs of compromise, making detection significantly more challenging than traditional malware infections.

Potential Risks & Impact

The Fake 7-Zip Installers campaign poses risks that extend far beyond individual users. By silently converting legitimate devices into residential proxy nodes, Lurking Lizard creates a distributed infrastructure that can be exploited for numerous cybercriminal activities while masking the true origin of malicious traffic.

Identity and Privacy Risks

Although the primary objective of the malware appears to be proxy monetization rather than credential theft, infected users still face significant privacy concerns.

Potential risks include:

• Internet traffic being routed through victims’ IP addresses.
• Reduced privacy due to unauthorized network usage.
• Increased exposure to additional malware payloads.
• Device performance degradation caused by background proxy operations.
• Potential misuse of residential IP addresses in illegal online activities.

Because the malware operates silently, many victims may remain unaware that their systems are participating in a criminal infrastructure.

Business Risks

Organizations whose employees unknowingly install trojanized software may experience wider security implications.

Potential business impacts include:

• Unauthorized use of corporate internet bandwidth.
• Increased security monitoring challenges.
• Higher likelihood of malware spreading within enterprise environments.
• Reputation damage if corporate IP addresses become associated with malicious activities.
• Additional incident response and remediation costs.

Businesses that allow software downloads without verification are particularly vulnerable to such supply-chain-style attacks.

Regulatory and Compliance Risks

Organizations affected by malware campaigns like this may also encounter compliance challenges depending on their industry and geographic location.

Potential concerns include:

• Failure to maintain adequate endpoint security controls.
• Violations of internal cybersecurity policies.
• Increased regulatory scrutiny following security incidents.
• Possible compliance implications under privacy and cybersecurity regulations if compromised devices expose sensitive business systems.

Although no evidence currently suggests that the campaign specifically targets regulated industries, organizations should treat unauthorized software installations as a significant cybersecurity risk.

Official Response

At the time of writing, no public statement has been issued by the operators of the impersonated software platforms regarding direct involvement in the campaign.

Security researchers continue to monitor the infrastructure associated with Lurking Lizard and have documented hundreds of malicious domains linked to the operation.

The discovery follows Google’s recent disruption of the NetNut (Popa) residential proxy botnet, demonstrating increased industry efforts to combat malicious residential proxy ecosystems.

Organizations are encouraged to monitor updates from trusted cybersecurity authorities and software vendors for additional indicators and defensive guidance.

Industry Context: Why Residential Proxy Malware Is Increasing

Residential proxy networks have become increasingly valuable within the cybercrime ecosystem. Unlike traditional proxy servers hosted in cloud environments, residential IP addresses appear far more trustworthy to websites, making them attractive for both legitimate businesses and cybercriminals.

Threat actors increasingly monetize malware infections instead of immediately stealing data. By selling access to compromised devices as proxy services, criminals generate recurring revenue while maintaining a relatively low profile. Security professionals can also review the MITRE ATT&CK framework to better understand techniques commonly used in malware delivery and persistence.

Several trends are contributing to the growth of these campaigns:

• Increasing demand for anonymous residential IP addresses.
• Growing popularity of free software download websites.
• Improved malware evasion techniques.
• Abuse of expired domains through drop-catching.
• Expansion of Malware-as-a-Service (MaaS) business models.

Readers interested in similar cyber incidents and malware campaigns can explore CyberNexora’s Cyber Incidents section.

Readers looking to learn how to avoid malware infections and fake software downloads can explore CyberNexora’s Learn & Protect section.

Organizations seeking cybersecurity tools, security checklists, and practical resources can browse CyberNexora’s Resources section.

How to Protect Yourself and Your Organization

Users can significantly reduce the risk of infection by following software security best practices.

1. Download Software Only From Official Sources

Avoid downloading applications from third-party websites or lookalike domains. Always verify the official website before installing software.

2. Verify Domain Names Carefully

Attackers often register domains that differ by only one or two characters from legitimate websites. Double-check spelling before downloading any software.

3. Enable Endpoint Protection

Use reputable antivirus and endpoint detection solutions capable of identifying trojanized installers and suspicious network activity.

4. Monitor Outbound Network Connections

Unexpected outbound connections may indicate that a device has been converted into a residential proxy node.

5. Keep Operating Systems Updated

Install the latest security patches to reduce the attack surface available to malware.

6. Educate Employees

Regular cybersecurity awareness training helps employees recognize fake download websites and software supply chain attacks.

7. Restrict Unauthorized Software Installation

Organizations should implement application allowlisting and restrict administrative privileges whenever possible.

8. Monitor DNS and Proxy Activity

Network administrators should investigate unusual DNS requests or persistent outbound proxy connections originating from internal systems.

Indicators of Compromise (IoCs)

While researchers have not publicly disclosed the complete list of indicators, organizations should remain alert for the following warning signs:

• Downloads originating from suspicious lookalike domains.
• Fake software installers impersonating trusted applications.
• Unexpected outbound proxy or relay traffic.
• Persistent background processes following software installation.
• Connections to unknown proxy infrastructure.
• Unauthorized network bandwidth consumption.
• Unusual endpoint behavior after installing free software.

Security teams should also monitor for domains impersonating:

• 7-Zip
• IPIDEA
• SmartProxy (Decodo)
• IP Royal
• 911Proxy

Key Takeaways

• Lurking Lizard is reportedly operating a large malicious residential proxy network using fake software installers.
• More than 230 deceptive domains have been identified distributing trojanized applications.
• Victims unknowingly become residential proxy nodes after installing counterfeit software.
• The campaign has expanded beyond fake 7-Zip installers to include WhatsApp, WireVPN, TikTok Downloader, and YouTube Downloader.
• The operation demonstrates the growing profitability of residential proxy malware within the cybercrime ecosystem.
• Organizations should strengthen software verification procedures and educate users about software supply-chain attacks.

Conclusion: Fake 7-Zip Installers and What Happens Next

The Fake 7-Zip Installers campaign highlights how cybercriminals are increasingly shifting from traditional malware operations toward long-term monetization through residential proxy networks. By abusing trusted software names, lookalike domains, and expired websites, Lurking Lizard has developed a scalable infrastructure capable of compromising thousands of unsuspecting users.

As researchers continue tracking the campaign, additional malicious domains and software packages may emerge. Individuals and organizations should remain cautious when downloading software, verify the authenticity of websites, and monitor their systems for unusual network activity. Strengthening software verification practices and endpoint security will remain essential in defending against this evolving threat landscape.