D-Link and Ubiquiti devices hijacked in proxyjacking campaign

A proxyjacking campaign has compromised network devices in at least 34 countries, using legitimate bandwidth-sharing software to turn victims’ internet connections into residential proxies. GreyNoise says the attackers installed Pawns.app without the device owners’ consent, allowing other traffic to pass through systems that appeared trustworthy.¹

How the campaign worked

Proxyjacking is the unauthorised use of someone else’s connection as part of a proxy network. Rather than relying only on easily detected malware, the campaign used an older version of Pawns.app, a legitimate rewards platform that previously offered bandwidth sharing. Pawns.app says the feature was discontinued in 2026, although older versions and related terms still created an opening for abuse.¹

GreyNoise identified compromised D-Link ShareCenter NAS devices, Ubiquiti UniFi Video NVRs and SAP NetWeaver Visual Composer systems. The researchers linked the activity to known vulnerabilities including CVE-2024-3272 and CVE-2024-3273 in D-Link devices, CVE-2021-44228 affecting Ubiquiti systems, and CVE-2025-31324 in SAP software.¹ Hikvision and Dahua DVR/NVR devices were also observed, although GreyNoise did not identify the vulnerabilities used against them.

At least 143 devices across 34 countries had been identified when the campaign was reported. BleepingComputer said the attackers were likely seeking payouts by placing compromised systems inside a commercial residential proxy network, where clean-looking IP addresses can be rented or used to hide criminal activity.²

What device owners should do

The campaign is a reminder that a familiar application can still be part of an attack when it is installed without consent. Organisations should patch internet-facing devices, remove unsupported hardware where possible and restrict administrative interfaces from the public internet. They should also watch authentication logs for unusual device or session identifiers, unexpected locations and connections associated with residential proxy infrastructure.¹²

GreyNoise has published a free IP-checking service that can show whether an address interacted with its Global Observation Grid. That is an indicator rather than proof of compromise, but it gives administrators a useful place to start investigating.¹

Our opinion

The most important detail here is not the brand names on the affected devices; it is the abuse of software that was designed to look legitimate. Security teams often train people to spot suspicious files, but a quietly installed rewards app can blend into a network while still turning the victim’s connection into an attacker-controlled asset. Patching the listed vulnerabilities matters, but so do access controls, application inventories and checking whether devices are making proxy-like outbound connections. This is a practical warning for anyone running older NAS, camera or network-video hardware: an internet-facing appliance is part of the security perimeter, even when it is not a conventional computer.