What is Proxyjacking?
Proxyjacking is installing proxyware on a machine you have broken into, so that its bandwidth and IP address can be sold through a proxy network for the attacker's benefit. Sysdig's Threat Research Team defined the term in April 2023, comparing it to cryptojacking: the attacker profits from stolen network access instead of stolen processor time.
Sysdig's report of 4 April 2023 described the case that gave the attack its name. The attacker exploited the Log4j vulnerability, CVE-2021-44228, in Apache Solr to run code on the server, then deployed a legitimate proxyware command-line client registered to the attacker's own account. From then on the victim's machine carried proxy traffic and the payments went to the attacker. The victim paid for the bandwidth and, as the visible source address, absorbed whatever that traffic did.
It is not limited to servers. Cisco Talos described modified proxyware clients with hardcoded credentials enrolling infected PCs under attacker accounts as early as August 2021, and AhnLab ASEC reported on 17 September 2026 that a group it tracks as Larva-25012 was installing proxyware without the user's consent on Windows systems it had already infected, through a loader registered in Task Scheduler that ran PowerShell commands. ASEC defines proxyjacking the same way Sysdig does: installing proxyware without the user's consent so that the profits go to the attacker.
Detection differs from cryptojacking because a relay needs network rather than processor time, so CPU alerts that catch miners may never fire. Look instead for a process you did not deploy that holds a long-lived outbound TLS or WebSocket connection, new services, scheduled tasks or containers, and steady egress that matches no workload. On a server, the proxyware is rarely the only thing an intruder left; patch the entry point, rebuild if you cannot account for every change, and rotate credentials.
Supply rules on the proxy network side decide how much a proxyjacked machine is worth to an attacker. At PROXIES.SX, only residential and mobile IPs can be listed for customer traffic and hosting or datacenter IPs are rejected, so a compromised cloud server is not routed customers. That does nothing for an infected home PC on a residential line. There the controls are contractual: bandwidth only from devices whose owners gave informed consent, an agreement signed in the partner's legal name and an account-linked key. Supplier declarations are not independently verified, so reports of software installed without consent matter.
Where you meet it
You meet proxyjacking in incident reports about exposed servers, in cloud-provider abuse notices, and when an unexpected egress bill arrives for a machine that should be idle. It is also why bandwidth-sharing guides tell you to run a client only on hardware you own and control, and never on a work, school or client network.
Common questions
What is the difference between proxyjacking and cryptojacking?
Both monetise a compromised machine for the attacker. Cryptojacking uses its processor to mine cryptocurrency; proxyjacking uses its network connection and IP address, enrolled in a proxy network under the attacker's account. Proxyjacking uses little CPU, so it can go unnoticed by monitoring tuned for miners.
How do I know if my server has been proxyjacked?
Look for an unfamiliar process or container holding a persistent outbound connection, services or scheduled tasks you did not create, and steady outbound traffic with no matching workload. Check what the process connects to and which account its configuration references. Then look for the original way in, which Sysdig traced to an unpatched vulnerability.
What should I do if I find proxyware I did not install?
Keep a copy of its configuration for the vendor, then remove it along with its service, task or container. Patch or rebuild the machine, rotate credentials and review other hosts on the same network. Report the enrolled account to the proxyware vendor so it stops being paid for your bandwidth.
Related terms
Real 4G/5G mobile and residential IPs
PROXIES.SX runs carrier IPs in 100+ countries with HTTP and SOCKS5 on every endpoint. $4/GB down to $2.40/GB at volume, free endpoints and rotation, and your GB never expire.