Global Proxyjacking Scheme Exploits D‑Link and Ubiquiti Routers to Sell Stolen Bandwidth

A coordinated cyber‑crime operation is repurposing home networking equipment from D‑Link and Ubiquiti into a commercial residential proxy service, allowing attackers to monetize the internet connections of unsuspecting users in at least 34 countries.

The campaign, identified by security researchers, works by compromising routers and embedding malicious code that redirects outbound traffic through a proxy network sold to third‑party clients. Victims’ bandwidth is thus leased out without their knowledge, generating revenue for the operators of the illicit service while leaving the original owners with degraded performance and potential exposure to illicit activity.

Technical analysis indicates the attackers target common vulnerabilities in D‑Link and Ubiquiti devices, including weak default credentials and outdated firmware. Once access is gained, a lightweight payload is installed that runs continuously, routing packets to the proxy pool while attempting to blend with legitimate traffic to avoid detection by ISPs or security tools.

For affected households, the symptoms can be subtle: slower download speeds, unexpected data usage spikes, or occasional connection drops. Because the traffic appears to originate from the user’s own IP address, any illicit activity conducted through the proxy could inadvertently implicate the homeowner, raising privacy and legal concerns.

Security experts advise users to secure their routers by changing default passwords, applying the latest firmware updates, and disabling remote management features unless absolutely necessary. Vendors have issued advisories, and law‑enforcement agencies are reportedly monitoring the situation. The episode highlights the broader risk posed by insecure Internet‑of‑Things devices, which continue to be co‑opted for profit‑driven cyber‑operations.