Proxyjacking campaign hijacks 143 devices using vulnerable D-Link, Ubiquiti, and SAP hardware

What the campaign involved

Security researchers at GreyNoise uncovered a proxyjacking campaign where attackers exploited vulnerabilities in devices from D-Link, Ubiquiti, SAP, Hikvision, and Dahua. According to TechRadar, the hackers installed Pawns.app, a legitimate bandwidth-sharing application, on compromised devices to hijack their internet connections.

The campaign targeted specific products, including D-Link ShareCenter NAS, Ubiquiti UniFi Video NVRs, SAP NetWeaver Visual Composers, and Dahua DVR/NVR systems. The vulnerabilities exploited included CVE-2024-3272 and CVE-2024-3273 for D-Link devices, CVE-2021-44228 for Ubiquiti devices, and CVE-2025-31324 for SAP systems.

How attackers exploited legitimate software

Pawns.app, originally a rewards platform for surveys and games, previously offered a bandwidth-sharing feature that allowed users to monetize their residential IP addresses by routing third-party traffic through them. According to TechRadar, the feature was discontinued in 2026, but older versions of the software still support it.

The app’s terms of service reportedly still reference traffic-sharing as a feature in some versions, creating a loophole for attackers. By installing Pawns.app on compromised devices, hackers could assimilate them into proxy networks, enabling anonymous criminal activity without the device owners’ knowledge or consent.

Scope and impact of the campaign

The campaign compromised at least 143 devices across 34 countries, according to TechRadar. The hijacked devices were added to proxy networks, where their bandwidth could be monetized for illicit purposes, such as masking the origin of cyberattacks, fraud, or other criminal activities.

GreyNoise has since launched a free service allowing users to check if their IP address interacted with its Global Observation Grid, which could indicate potential compromise.

Background on proxyjacking

Proxyjacking is a form of cyberattack where attackers hijack a device’s internet connection and assimilate it into a proxy network. Unlike traditional malware, which often relies on malicious code, proxyjacking can leverage legitimate software to evade detection. This method allows attackers to monetize hijacked bandwidth while shifting legal and operational risks to the unwitting device owners.

Proxy networks are often used to obscure the origin of cyberattacks, facilitate fraud, or bypass geolocation restrictions. The rise of bandwidth-sharing platforms like Pawns.app has created new opportunities for attackers to exploit such systems.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

Proxyjacking represents a growing risk for businesses and individuals who rely on outdated or unpatched hardware. Unlike traditional malware, this attack leverages legitimate software to monetize hijacked bandwidth, making detection harder and blurring the line between victim and enabler. For founders and operators, this underscores the importance of robust vulnerability management—not just for software but also for networked hardware, which is often overlooked. The use of residential IP proxies for criminal activity also highlights a broader trend: attackers are increasingly abusing trust-based systems to evade detection and legal scrutiny.

Key takeaways

• Unpatched vulnerabilities in networked hardware (e.g., NAS, NVRs, surveillance systems) remain a prime target for cybercriminals.
• Legitimate software like Pawns.app can be repurposed for malicious activities, complicating detection and attribution.
• Proxyjacking is illegal and can turn compromised devices into unwitting participants in criminal networks.
• Regular audits of networked devices and timely patches are critical to mitigating such risks.
• Businesses should monitor for unusual bandwidth usage, which may indicate proxyjacking or other forms of hijacking.

FAQ

What is proxyjacking?

Proxyjacking is a cyberattack where hackers hijack a device’s internet connection and integrate it into a proxy network. This allows them to monetize the device’s bandwidth for criminal activities, such as masking the origin of cyberattacks or facilitating fraud, without the owner’s knowledge.

How can I tell if my device has been proxyjacked?

Signs of proxyjacking may include unusual network activity, increased bandwidth usage, or unexplained slowdowns. GreyNoise offers a free service to check if your IP address has interacted with its Global Observation Grid, which could indicate potential compromise.

What should I do if my device is compromised?

If you suspect your device has been proxyjacked, disconnect it from the internet immediately. Update all firmware and software, change passwords, and run a malware scan. Consider contacting a cybersecurity professional for further assistance.

Related on Lazyfounder

• SAP
• More technology news