Lurking Lizard

Lurking Lizard is a residential proxy business operation disclosed by Infoblox that uses trojanized software installers — particularly fake 7-Zip installer executables — to turn victims' devices into residential proxy nodes without their knowledge.

Operation

• 230+ lookalike domains distributing trojanized installers
• Victims download fake 7-Zip installers from search-engine-optimized malware sites
• Infected devices become part of a residential proxy network
• Activity dating to at least August 2022 (raw/digests/Cyber-Digest-2026-07-10)

Comparison: NetNut

This operation mirrors the commercial residential proxy model used by Netnut (taken down by FBI in July 2026), but operates at a smaller scale and without a publicly-traded parent company.

Related Pages

• Netnut Takedown — FBI takedown of a similar, larger residential proxy operation
• Wp Shellstorm — Another operation using compromised infrastructure