Security researchers have uncovered a proxyjacking campaign that compromises routers and other internet-connected devices made by D-Link and Ubiquiti. The operation has affected devices in 34 countries, according to a report from BleepingComputer.
Instead of installing ransomware or stealing data, the attackers use the hijacked devices to route traffic through a commercial residential proxy network. This lets them resell the victims' bandwidth to third parties, effectively turning each compromised device into a paid relay.
Residential proxies are often marketed as legitimate tools for ad verification or web scraping, but they are also used to disguise malicious traffic. Because the devices continue to function normally, owners may not notice that their connection is being shared.