GreyNoise, a security firm, said it found a proxyjacking campaign. An attacker forces other people's devices to share their internet connection with a paid proxy network. BleepingComputer reported on 15 October 2026 that the attacker compromised at least 143 devices in 34 countries. It listed the flaws used: CVE-2024-3272 and CVE-2024-3273 in D-Link ShareCenter storage devices, CVE-2021-44228 in Ubiquiti UniFi Video recorders, and CVE-2025-31324 in SAP NetWeaver Visual Composer. The attacker then installed Pawns.app, which pays users to share bandwidth, without the owners' consent. In some cases it also added SSH key login as a backup way in.
GreyNoise said the attacker also seemed to target Hikvision and Dahua video recorders. BleepingComputer said GreyNoise did not name the flaws used on those. The 143 figure is a minimum. Separately, an organisation saw GreyNoise-flagged home-style addresses in its Entra ID sign-in logs and confirmed a serious intrusion. GreyNoise will not publish those details. The sources do not link that case to these 143 devices.
GreyNoise said home-style proxy addresses defeat checks that flag logins from unexpected places. It said a device on a user's network could be part of a proxy network. So an address that looks normal in sign-in logs may not be safe. GreyNoise advises keeping devices patched and watching for several staff signing in from one home address.