Cisco Talos researchers point out that so-called proxyware, which is used to share an Internet connection, is becoming increasingly important in the field of cybercrime. Hackers use the legitimate services for illegal purposes to gain wealth from their victims.
Proxyware, also known as internet sharing applications, allows users to share some of their internet connection with other devices. But they also allow you to “host” a hotspot internet connection and receive money every time another user connects to it.
According to the researchers, proxyware is abused in the same way as legitimate cryptocurrency mining software: it is installed unobtrusively – either as a secondary component or as a main payload – and efforts are made to prevent a victim from noticing its presence, for example through surveillance resource use and obfuscation.
Alternatively, criminals use proxyware to install it on a compromised PC and to register the software there with an attacker’s account. While the victim provides their bandwidth, the attacker collects the fees due.