All about that proxy.

Infoblox researchers detail 'Lurking Lizard', an active threat actor (since at least 2022) that leverages fake installers, VPNs, and lookalike domains to covertly recruit victim devices as residential proxy nodes; analysis links over 230 domains and multiple campaigns (including fake 7‑Zip, downloader tools, and WireVPN) to an end-to-end proxy operation that monetizes compromised bandwidth.