Proxyjacking is the unauthorized use of compromised devices as proxy nodes, relaying other people’s internet traffic to generate profit. A device may be enrolled in a commercial proxy network, making connections appear to come from its residential or business IP address. Unlike attacks focused primarily on stealing files, proxyjacking monetizes the victim’s network access and computing resources.
Attackers may gain access through exposed or unpatched network appliances or enterprise software, then install software that keeps the device serving as a relay. Signs can include unexplained bandwidth use, unusual outbound connections, or degraded performance. Defenders should patch and restrict access to internet-facing devices, review unexpected processes, and monitor outbound traffic for relay-like activity. A legitimate bandwidth-sharing application can also become a security concern when installed without the owner’s consent.