type: entity · created: 2026-07-11 · updated: 2026-07-11 · tags: [cybercrime-group, c2, loader] · confidence: medium · affected_sectors: [technology] · au_impact: false
Lurking Lizard
Lurking Lizard is a residential proxy business operation disclosed by Infoblox that uses trojanized software installers — particularly fake 7-Zip installer executables — to turn victims' devices into residential proxy nodes without their knowledge.
Operation
- 230+ lookalike domains distributing trojanized installers
- Victims download fake 7-Zip installers from search-engine-optimized malware sites
- Infected devices become part of a residential proxy network
- Activity dating to at least August 2022 (raw/digests/Cyber-Digest-2026-07-10.md)
Comparison: NetNut
This operation mirrors the commercial residential proxy model used by NetNut (taken down by FBI in July 2026), but operates at a smaller scale and without a publicly-traded parent company.
Related Pages
- Netnut Takedown — FBI takedown of a similar, larger residential proxy operation
- Wp Shellstorm — Another operation using compromised infrastructure