Fake 7-Zip Downloads Are Quietly Turning Home PCs Into Criminal Middlemen

Key points

• Infoblox has named a new criminal operation Lurking Lizard, active since at least August 2022.
• The group runs more than 230 lookalike websites that imitate legitimate software download pages.
• A recent campaign hid the malware inside fake installers for 7-Zip, the free file compression program.
• Infected home and office computers are silently rented out as residential proxies, meaning internet middlemen that let criminals borrow ordinary people's connections.
• The operation is end to end: the same group builds the fake installers, operates the malware, and sells access to the resulting network.

A newly named criminal crew has spent more than three years quietly turning ordinary people's computers into hired muscle for other cybercriminals.

The group, which DNS security firm Infoblox is calling Lurking Lizard, has been active since at least August 2022. Infoblox tracks the domain names criminals use, and it says this crew has stood up over 230 lookalike sites designed to trick people searching for popular free software. Our earlier reporting on NetNut covered a disrupted proxy network built on a similar model; Lurking Lizard hasn't been touched.

One recent campaign pushed a fake version of 7-Zip, the free tool most people use to open compressed files. It's downloaded millions of times a month, which makes it reliable bait.

What actually happens when someone installs the fake 7-Zip?

The victim gets a working copy of 7-Zip, so nothing looks wrong. Quietly, in the background, the installer drops software that turns the machine into a residential proxy node.

A residential proxy is a middleman connection. Instead of a criminal's traffic coming from a suspicious data centre abroad, it exits through a normal home broadband line. Websites and banks treat it as a regular customer. That's exactly why criminals pay for it.

The rented-out connection can then be used for credential stuffing (trying stolen passwords against banking sites) or ad fraud. The person who owns the infected computer sees none of it, apart from maybe a slower connection and a higher electricity bill.

Why Lurking Lizard is different

Plenty of malware families sell access to infected machines. What sets this crew apart, according to Infoblox, is that they run the whole pipeline themselves: registering the lookalike domains, building the fake installers, operating the malware, and selling access to the resulting proxy network directly to customers.

That vertical setup is unusual. Most proxy botnets involve at least two or three separate criminal businesses stitched together. One outfit doing all of it means faster iteration and fewer people taking a cut.

Infoblox hasn't published a full list of the 230-plus domains, and no CVE is involved here. This is social engineering plus malware, not a software flaw.

Should you worry?

If you downloaded 7-Zip recently from anywhere other than 7-zip.org, yes. More broadly, watch the top results on a search engine when you look for free software. Criminals routinely buy ads that sit above the real download link.

A few practical signs something is off after an install: your computer's fan runs constantly when you're doing nothing, your internet feels slower than it should, or your bank flags logins from places you've never been. Any of those warrants a proper malware scan.

For IT teams, block newly registered lookalike domains at the DNS layer and treat outbound connections from user machines to unknown proxy ports as suspicious by default. A finance workstation suddenly opening thousands of short-lived connections to random residential IPs is a problem worth investigating immediately.

Lurking Lizard is a reminder that you don't need a zero-day (an unknown software flaw) to build a serious criminal business. A convincing fake download page and a patient three-year runway will do it. What to watch next is whether law enforcement acts here as quickly as it did against NetNut.