Malicious Apps Caught Secretly Turning Android Phones into Proxies for Cybercriminals

**PROXYLIB**: Several malicious Android VPN apps on Google Play used a native Golang library and the LumiApps SDK to covertly convert infected mobile devices into residential proxy nodes (RESIPs); Google removed 29 apps after discovery. Operators reportedly enroll devices, route traffic through them, sell access to the proxy network via services like LumiApps and Asocks, and incentivize developers to expand the botnet, enabling threat actors to obfuscate origins and facilitate further abuse.