Attackers are hijacking forgotten office devices and renting out their internet connections, and GreyNoise, a threat intelligence company, published the evidence on October 15.

The practice is called proxyjacking. An attacker breaks into a device, such as a network storage box or a security video recorder, and installs a legitimate app that pays people for sharing their internet connection, registered under the attacker's own account. Strangers then send their traffic through the victim's connection, and the attacker collects the payment.

Some buyers of that traffic are criminals who want to hide where they are, and because their activity appears to come from the victim's address, a login with a stolen password can look like an employee signing in from home.

GreyNoise found at least 143 hijacked devices in 34 countries

GreyNoise calls the attacker skynox7 and says the attacker took over at least 143 devices in 34 countries (GreyNoise, 2026). The victims included D-Link network storage boxes and Ubiquiti security video recorders, along with SAP business software. The attacker also appeared to go after recorders from Hikvision and Dahua.

Published flaws and a legal app were all the attacker needed

The attacker got in through weaknesses that security researchers had already catalogued and published, and one of them has been public since 2021.

Once inside, the attacker installed Pawns.app, a legitimate program that pays people to share their internet connection. Pawns.app is a partner of IPRoyal, a company that sells access to home internet connections, and the installer can register it under any account they choose. That suits an attacker, because every hijacked device pays into the same account. On some devices the attacker also left a hidden way back in.

GreyNoise points out that the program does the same job whether an owner or an attacker installs it, which makes the attack hard to spot from the software alone.

Proxyjacking leaves everything running at normal speed, so the problem surfaces when someone thinks to ask.

A login from the right city no longer proves the person is there

GreyNoise began this research during a product demonstration for a customer. The customer's Microsoft sign-in records showed logins from addresses that GreyNoise had flagged as malicious. The addresses looked like ordinary homes in the cities where the customer's employees live.

Then the customer noticed several employees signing in from the same home address, which GreyNoise says is unlikely to have an innocent explanation. The customer dug deeper and confirmed a serious break-in. GreyNoise has not published the details and treats that case and the 143-device campaign as separate findings.

Identity tools catch stolen passwords by watching for a login from an unexpected place, such as one city followed minutes later by another across the world. A hijacked device defeats that check because the attacker signs in from an address that matches where the employee lives or works. GreyNoise says foreign intelligence services use these networks for this reason.

Blocking those addresses carries a cost, since GreyNoise notes that an honest login can come from the same address that is carrying a stranger's traffic. The Federal Bureau of Investigation advises businesses to block addresses tied to these networks, and doing both locks out the employee whose home storage box was hijacked.

Laptop security software and takedowns both miss the hijacked devices

Security software installs on laptops and servers, and a storage box or a video recorder runs the manufacturer's own software, which leaves no place for an extra program. A recorder that nobody listed never shows up on an update report, and the people in the building may not know it is connected to the internet.

I saw a related problem at Network Solutions. Every time our public relations work put the company in the news, the operations team had to fight off attacks that flood a website with traffic, and most of that work happened without the tools available today. The service slowed in ways the whole team felt. Proxyjacking leaves everything running at normal speed, so the problem surfaces when someone thinks to ask.

Law enforcement is going after the sellers. In July 2026 the bureau and private partners seized hundreds of website domains tied to NetNut, a service that sold access to home internet connections, according to Krebs on Security. Google said the action cut millions of devices from NetNut's pool, and it warned that these networks can rebuild by reselling other services (Krebs on Security, 2026).

The hijacked devices sit on networks owned by someone else. I read that as a supply problem: until someone fixes or replaces a device, any seller can sign it up again.

The 143 count is a minimum, and the break-in link is unproven

GreyNoise reports at least 143 devices, so the true number could be higher. It has not tied the customer's break-in to this campaign, and it did not say which weaknesses the attacker used against the Hikvision and Dahua recorders, so those owners cannot yet check their own devices.

GreyNoise sells threat intelligence, and this research began in one of its customer demonstrations. Security teams can find the specific flaw numbers and technical markers in GreyNoise's report and check them against their own systems without buying anything.

Start with one sign-in review and one device list this week

1. Ask your security team to check the last thirty days of sign-ins for any home address used by more than one employee. GreyNoise names this as a pattern to look into.
2. Have them compare each login's device and browser details against that person's usual history, since the city alone proves little.
3. Look at what your storage boxes and video recorders connect to on the internet, and flag destinations with no business reason, a step I am adding to GreyNoise's list.
4. List every network device in every office, branch offices included, and name one person responsible for keeping each one updated.
5. Hand the technical markers from GreyNoise's report to your security team to check against your systems.

GreyNoise also recommends telling employees to update their personal devices and to think twice before installing free apps.