Malicious 7-Zip site distributes installer laced with proxy tool

A malicious campaign uses a fake 7-Zip website (7zip.com) to distribute a trojanized installer that includes the legitimate 7-Zip binary plus three malicious components (Uphero.exe, hero.exe, hero.dll). The malware installs to C:\Windows\SysWOW64\hero, creates a SYSTEM auto-start service, alters firewall rules, profiles hosts via WMI/APIs, and enrolls infected systems as residential proxy nodes communicating with rotating hero/smshero C2 domains over Cloudflare and DoH with XOR-obfuscated control messages; researchers (Malwarebytes and independent analysts) have published IOCs and detection/mitigation guidance.