Fake Installers, Fake Reviews, Fake Services – Real Proxies, Real Victims

This report details an end-to-end malicious residential proxy operation, ‘Lurking Lizard,’ that uses lookalike domains and trojanized installers (e.g., fake 7-Zip, WireVPN-branded binaries) and mobile apps to enroll devices as proxy nodes; investigators linked campaigns from 2022–2026 via a hardcoded IPLogger beacon, shared APIs, DNS/WHOIS patterns, and deployment fingerprints across more than 230 domains, indicating a structured, monetized criminal ecosystem rather than isolated malware incidents.