Security explainer

What is proxyware?

Proxyware is software that shares a device's internet connection with a proxy network, so that other people's web requests leave from that device's IP address. People install it knowingly to be paid for bandwidth; attackers install it secretly on machines they have compromised, which is called proxyjacking. This page sets out what security researchers have documented, and how to find and remove it.

Disclosure: PROXIES.SX operates a bandwidth-sharing network, so its own clients are proxyware in this sense. How to remove ours comes first below; everything else applies to any vendor.

Checked on against the sources listed below

Removing the PROXIES.SX peer

Removing the PROXIES.SX peer
PlatformStop itThen
Linux (proxies-peer service)sudo systemctl disable --now proxies-peerDelete /usr/local/bin/proxies-peer, /etc/systemd/system/proxies-peer.service, /etc/proxies-peer, /var/lib/proxies-peer and /var/lib/private/proxies-peer, run sudo systemctl daemon-reload, then remove the device in the farmer dashboard
Windows (start.bat window or NSSM service)Close the window, or run nssm stop ProxiesPeer and nssm remove ProxiesPeer confirmDelete the folder and any scheduled task that runs start.bat
Docker (reference-sdk.js)docker rm -f proxies-peerRemove the state volume: docker volume rm proxies-peer-state
Android (inside an app)Turn sharing off in the appUninstall the app

If you did not install it and believe someone else did, stop it with the steps above and email maya@proxies.sx with the device name and the time you found it. Suppliers must have the informed consent of every device owner.

How proxyware works

The client opens an outbound connection to the vendor's servers and waits. When a customer of the proxy network sends a request, the vendor routes it down that connection; the client opens a connection from the device to the destination website and passes the data back. The website sees the device's IP address, not the customer's.

Cisco Talos described the model in 2021: proxyware platforms “enable users to sell the use of their unused internet bandwidth, typically by running a client application”, which joins the system to a network operated by the platform provider. In practice, because the device only makes outbound connections, nothing changes on the router, and the traffic looks like the device's own.

What security researchers found

Research on proxyware
DateSourceFinding
Aug 2021Cisco TalosAttackers installed legitimate proxyware clients silently and bundled them with trojanized installers and cryptocurrency miners, to be paid for victims' bandwidth.
Feb 2023Trend MicroClassed bandwidth-sharing apps as "riskware applications that we call proxyware", because the people who install them have no means of controlling or monitoring what traffic goes through their exit node; observed SQL injection probing, security scans and crawling of government sites through exits.
Apr 2023SysdigNamed "proxyjacking": an attacker used the Log4j vulnerability for access, then installed proxyware, estimating up to $10 a month per compromised device for the attacker.
Jun 2025FBIWarned that compromised home devices such as TV streaming boxes and digital picture frames can become part of the BADBOX 2.0 botnet and residential proxy services known to be used for malicious activity.
Jan 2026Google Threat Intelligence GroupDisrupted a large residential proxy network, removed apps carrying its SDKs through Play Protect, and told consumers to be "extremely wary" of apps that pay for unused bandwidth.
Sep 2026AhnLab ASECReported a threat actor it tracks as Larva-25012 distributing proxyware to already infected systems in the second half of 2026.

The risks if you run it yourself

Your IP carries other people's traffic. Websites, abuse desks and your internet provider see your address as the source. Trend Micro observed exits used for SQL injection probing and access to SMS verification services.

Your provider's terms. Some internet providers prohibit running proxy services; Xfinity's acceptable use policy lists “proxy services and servers”. Check yours first.

Your local network. Keep the client on a separate or guest network to limit which of your devices it can reach.

Detection. Security products may flag or remove proxyware, especially when it arrives bundled with other software.

How to find proxyware you did not install

Proxyware uses network capacity rather than processor time, so a machine can look idle while carrying traffic. Check installed programs, services, scheduled tasks, startup items and running containers for anything you do not recognise, then look for processes that hold long-lived outbound connections.

Linux: services and outbound connections
systemctl list-units --type=service --state=running
sudo ss -tnp state established
docker ps --format "{{.Names}} {{.Image}}"
Windows (PowerShell): processes with connections
Get-NetTCPConnection -State Established |
  Select-Object RemoteAddress, RemotePort, OwningProcess |
  Sort-Object OwningProcess
Get-ScheduledTask | Where-Object State -eq Ready

If you find a client you did not install, treat the machine as compromised: proxyjacking often arrives with or after another intrusion, as in the Talos, Sysdig and ASEC reports. Remove the client, then look for how the attacker got in.

Questions

What is proxyware?
Software that shares part of a device's internet connection with a proxy network, so other people's web requests leave from that device's IP address. Cisco Talos described proxyware platforms in 2021 as letting users "sell the use of their unused internet bandwidth, typically by running a client application".
Is proxyware malware?
Not by itself. Installed knowingly, it is a program that does what it says. Security vendors treat it cautiously because it can carry traffic its owner cannot see or control, and because attackers install it on machines they have broken into. Trend Micro classes such apps as riskware.
What is proxyjacking?
Installing proxyware on someone else's machine without consent and collecting the payments. Sysdig named the attack in April 2023 after seeing it follow a Log4j exploit, and AhnLab reported a group distributing proxyware to already infected systems in September 2026.
How do I know if proxyware is running on my computer?
Look for programs, services, scheduled tasks or containers you did not install, and for a process that keeps a long-lived outbound connection open while the machine is idle. Proxyware uses network capacity rather than processor time, so it may not show up as high CPU.
Is it safe to share my bandwidth for money?
It carries real risks: your IP becomes the visible source of other people's traffic, your provider's terms may prohibit it, and security software may flag the client. Google advised consumers in January 2026 to be "extremely wary" of apps that pay for unused bandwidth. If you do it, use a client you installed yourself, on a network separate from your other devices.

Sources