Slashdot has reported:

A proxyjacking campaign has used compromised devices in 34 countries to route other users’ internet traffic through victims’ connections, generating money through a commercial residential proxy network. The operator installed Pawns.app, a legitimate bandwidth-sharing service, without the device owners’ consent.

Pawns.app account holders earn money when other users’ traffic passes through their network on trusted IP addresses that do not block it. Researchers said the attacker likely increased payouts by installing the app across multiple systems. Threat intelligence company GreyNoise found the activity while investigating suspicious behaviour at an unnamed organization and identified at least 143 affected devices worldwide.

The attacker exploited known vulnerabilities in D-Link ShareCenter network-attached storage devices, CVE-2024-3272 and CVE-2024-3273; Ubiquiti UniFi Video NVR, CVE-2021-44228; and SAP NetWeaver Visual Composer, CVE-2025-31324, to install the software. Hikvision and Dahua DVR/NVR devices were also targeted, although the specific vulnerabilities used against them were not identified.

In some cases, the attackers set up SSH key authentication to preserve backup access to compromised systems. The campaign monetized victims’ internet connections by routing traffic through their devices.