GhostSocks Malware as a Service Empowers Threat Actors to Turn Compromised Devices into Proxies

GhostSocks is a Malware-as-a-Service that enables attackers to convert compromised Windows hosts into SOCKS5 residential proxies via customizable Go-compiled DLLs or executables with runtime-obfuscated strings; it uses a C2 relay list, generates random credentials for proxy sessions, and relies on complementary malware (e.g., LummaStealer) for persistence and redeployment. The service has seen increased criminal adoption, is linked to ransomware actor discussions, is actively developed, and defenders are advised to block known relay IPs, monitor anomalous SOCKS5 traffic, and enforce Zero Trust controls.