Your computer may be part of a major proxy service without you even knowing. To make matters worse, someone out there is getting paid to offer these IP addresses, and the bandwidth, to their customers.

These are the findings of AT&T Alien Labs, published earlier this week. As reported by BleepingComputer, a threat actor created a piece of malware and distributed it through game cracks and other illegal software. 

The malware silently downloads and installs a proxy application, without user knowledge or consent. Antivirus programs weren’t flagging the proxy application as malicious, either.

Hundreds of thousands of victims

When the installation is complete, the infected endpoint becomes part of a proxy network which the malware’s operators then sold as a proxy service to its clients and customers. Apparently, more than 400,000 Windows systems were compromised this way. 

To make matters worse, the company behind the botnet claims that all of the victims gave their consent, and willingly became part of the proxy infrastructure. However, researchers at Alien Labs beg to differ: 

“Although the proxy website claims that its exit nodes come only from users who have been informed and agreed to the use of their device, Alien Labs has evidence that malware writers are installing the proxy silently in infected systems.”

They added, “as the proxy application is signed, it has no anti-virus detection, going under the radar of security companies.”

While we don’t know the name of the threat actors behind the campaign, the researchers said it’s almost identical to an earlier campaign targeting macOS systems. In that campaign, a malware named AdLoad was being distributed. 

To double-check whether your device was compromised, AT&T’s researcher says users should look for a “Digital Pulse” executable located at “%AppData%”, or a similar Registry key found in “HKCUSoftwareMicrosoftWindowsCurrentVersionRun.” and remove it.

Via: BleepingComputer

Go to Source

Follow us on FacebookTwitter and InstagramWe are growing. Join our 6,000+ followers and us.

At will strive to help turn Tech Rookies into Pros!

Want more articles click Here!

Deals on Homepage!

M1 Finance is a highly recommended brokerage start investing today here!

WeBull. LIMITED TIME OFFER: Get 3 free stocks valued up to $6300 by opening & funding a #Webull brokerage account! “>Get started >Thanks for visiting!

Subscribe to our newsletters. Here! On the homepage

Tech Rookies Music Here!

Disclaimer: I get commissions for purchases made through links in this post at no charge to you and thanks for supporting Tech Rookies.

Disclosure: Links contain affiliates. When you buy through one of our links we will receive a commission. This is at no cost to you. Thank you for supporting

Disclaimer: This article is for information purposes and should not be considered professional investment advice. It contains some forward-looking statements that should not be taken as indicators of future performance. Every investor has a different risk profile and goals. All investments have risks. Always do your own research or hire an expert before investing and trading.