Hackers Weaponizing 7-Zip Downloads to Turn Your Home Computers into Proxy Nodes

A counterfeit 7‑Zip installer hosted on 7zip.com installs legitimate 7‑Zip alongside concealed malware (Uphero.exe, hero.exe, hero.dll) that register as SYSTEM services, alter firewall rules, profile hosts, and enroll victims into a residential proxy network communicating with "smshero"-themed C2 domains over HTTPS; the campaign uses an abused Authenticode signature, XOR-encoded control traffic (key 0x70), non-standard proxy ports (1000, 1002) and DNS-over-HTTPS to evade detection—users who downloaded from 7zip.com should treat systems as compromised and follow removal or full OS reinstall recommendations.