The threat actor tracked as skynox7 has hijacked at least 143 devices in 34 countries and enrolled them into the Pawns.app residential proxy network without their owners' consent, according to research published by GreyNoise on 15 October 2026.
How the campaign worked
GreyNoise discovered the campaign while responding to an intrusion it had spotted during a live product demo, when an organization's Entra ID sign-in logs showed logins from residential IP addresses that GreyNoise flags as proxy infrastructure. Follow-up research revealed a monetization campaign: skynox7 exploited known vulnerabilities in internet-facing edge devices and installed Pawns.app, a legitimate bandwidth-sharing app that pays users for sharing their internet connection, on devices it did not own.
The exploited vulnerabilities were:
- CVE-2024-3272 and CVE-2024-3273 in D-Link ShareCenter NAS devices
- CVE-2021-44228 (Log4Shell) in Ubiquiti UniFi Video NVRs
- CVE-2025-31324 in SAP NetWeaver Visual Composer
GreyNoise also observed targeting of Hikvision and Dahua DVR/NVR devices. In some cases the attacker configured SSH key authentication as a backup way back into compromised machines.
The payout side
According to GreyNoise's analysis of the attacker's toolkit and sensor data, the compromised devices were registered to a Pawns.app payout account ([email protected]), shared 281.84 GB of bandwidth and earned the attacker about $56.62. The Pawns.app client was renamed "gotoschool" and set to restart on reboot. Pawns.app is a direct sourcing partner of IPRoyal, so the hijacked devices ultimately served residential proxy traffic to IPRoyal customers.
Why it matters for proxy users
Pawns.app is a legitimate service whose terms require it to run only on devices the user lawfully controls — the attacker simply accepted those terms on the victims' behalf. Even legitimate proxy networks can route suspicious traffic through nodes they do not properly vet, which can lead to IP blocks for honest participants or, as GreyNoise's related intrusion case showed, make it possible for attackers to log into corporate systems from residential IPs that look completely normal. Keeping NAS devices, NVRs and other internet-facing systems patched and locked down remains the most effective protection against proxyjacking.