Proxyjacking campaign installs Pawns.app on edge devices

GreyNoise says skynox7 used known flaws to install Pawns.app on at least 143 devices in 34 countries.

GreyNoise identified a proxyjacking campaign that compromised at least 143 devices in 34 countries by installing the legitimate residential proxy client Pawns.app without owners' consent. GreyNoise and Cyber Security News track the actor as skynox7, and GreyNoise links Pawns.app to IPRoyal, while BleepingComputer names neither the actor nor that vendor tie and GBHackers says the activity is not attributed to a named operator. All four reports say initial access used D-Link ShareCenter flaws CVE-2024-3272 and CVE-2024-3273, Ubiquiti UniFi Video CVE-2021-44228, and SAP NetWeaver Visual Composer CVE-2025-31324. GreyNoise, BleepingComputer, and GBHackers say Hikvision and Dahua recorders were also targeted, with GBHackers adding that the vulnerabilities used were not identified; Cyber Security News says that targeting was not confirmed as successful. On some devices, attackers added SSH keys for backup access. GreyNoise says residential proxy exits can defeat impossible-travel and VPS detections; BleepingComputer adds that victims' IPs may be blocked or associated with abuse such as credential stuffing; Cyber Security News notes the installed binaries are not inherently malware.

• At least 143 devices in 34 countries were compromised.
• Initial access used D-Link ShareCenter CVE-2024-3272 and CVE-2024-3273, Ubiquiti UniFi Video CVE-2021-44228, and SAP NetWeaver Visual Composer CVE-2025-31324.
• Pawns.app residential proxy software was installed without consent; GreyNoise links it to IPRoyal.
• GreyNoise and Cyber Security News name the actor skynox7; GBHackers says the activity is not attributed to a named operator.
• Attacker SSH keys were added on some devices for backup access.
• Sources disagree on Hikvision and Dahua: earlier reports say recorders were targeted, while Cyber Security News says compromise was not confirmed.
• Residential proxy exits can defeat impossible-travel and VPS detections and may get victims' IPs blocked or tied to abuse.