A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.

ASEC reports that Larva-25012 resumed distributing Proxyware in the second half of 2026 by exploiting already infected systems, with recent cases involving DigitalPulse, SOAX, Appsalt, and IPRoyal. The campaign uses DPLoader, PowerShell downloaders, scheduled tasks, and loader/DLL sideloading to install Proxyware and disable defenses on systems in Korea. #Larva-25012 #DPLoader #DigitalPulse...

Proxyware Malware Being Distributed on YouTube Video Download Site - 2 ASEC

A new report reveals that malicious YouTube video downloader sites are tricking users into installing Proxyware, a type of malware that hijacks network bandwidth.

AhnLab ASEC, publié le 17 septembre 2026. L'article documente la reprise active d'une campagne de proxyjacking menée par le groupe Larva-25012, actif depuis au moins 2025, ciblant principalement des systèmes en Corée du Sud.

Analysis of the CVE-2025-32432 compromise chain by Mimo: exploitation, loader, crypto miner, proxyware, and detection opportunities.

Analysis of the CVE-2025-32432 compromise chain by Mimo: exploitation, loader, crypto miner, proxyware, and detection opportunities.

 Proxyware, a digital citizen protection company dedicated to safeguarding vulnerable populations, announced today the expansion of its program into Virginia schools to reduce child exploitation and digital harm. Already this calendar year, Proxyware has detected more than 192,000 digital attacks targeting Virginia K-12 school children, underscoring the urgent need for comprehensive protection. Children across the Commonwealth face relentless digital threats.

The discovery of proxyware infections through the K-Lite Codec Pack highlights a growing concern in the cybersecurity landscape. Proxyware, which turns infected machines into proxy servers, has been found in the systems of a cybersecurity professional's family members. The software, attributed to Infatica and Digital Pulse, was inadvertently installed via a seemingly legitimate software bundle, raising questions about the ethical practices of proxy providers and the prevalence of such infections. Proxyware operates by leveraging the infected machine's resources to route internet traffic, often for malicious purposes such as web scraping, ad fraud, or other cybercriminal activities. The use of residential proxies, which are IP addresses provided by Internet Service Providers (ISPs) to homeowners, makes these activities harder to detect and block, as they appear to originate from legitimate residential networks. The implications of such infections are significant. Unauthorized data transmission can lead to privacy violations and potential legal issues for the unwitting participants. Moreover, the infected machines can become entry points for further malware infections, compromising the overall security of the network. From a cybersecurity perspective, this incident underscores the importance of vigilance when downloading software, even from seemingly reputable sources. The K-Lite Codec Pack, a popular multimedia software bundle, serves as a reminder that malware can be hidden in plain sight. Users are advised to employ robust antivirus solutions, regularly monitor network activity for anomalies, and exercise caution when installing software from the internet. While companies like Infatica and Digital Pulse may not be household names, their activities are well-documented within cybersecurity circles. The use of proxyware to build residential proxy networks is a known tactic, and the prevalence of such infections suggests a need for greater awareness and preventive measures among users and organizations alike. In conclusion, the discovery of proxyware infections via the K-Lite Codec Pack serves as a stark reminder of the evolving tactics employed by cybercriminals. By understanding the technical implications and adopting proactive security measures, users can better protect themselves against such threats.

Cyber Incidents · IntelFusions threat intelligence

Introduction: The convergence of IoT botnets with privacy-centric technologies like Tor and blockchain-based naming systems marks a dangerous evolution in malware tactics. The newly discovered Lorikazz botnet specifically targets Android TV and set-top boxes (STBs), disguising ELF payloads as system libraries while using Tor .onion domains for command-and-control (C2) and Ethereum Name Service (ENS) for resilient domain resolution. This article dissects the technical architecture of Lorikazz, provides hands-on detection and analysis commands, and outlines mitigation strategies for security professionals.

How attackers rent the trust of ordinary homes, cars, and CDNs so their traffic looks normal, and why a residential IP shouldn't round up to safe.

Learn how a threat actor runs an end-to-end residential proxy business using lookalike domains, fake software downloads, and a connection to Chinese IPIDEA.