Security firm GreyNoise says an attacker broke into at least 143 internet-facing devices in 34 countries and quietly installed Pawns.app on them. Pawns.app is a real “earn on your internet” program that pays account holders for letting other people’s traffic flow through their connection. The attacker did not ask: by installing it on devices they did not own, they likely earned larger payouts while victims’ connections carried strangers’ traffic. GreyNoise calls this proxyjacking, and it found the campaign while looking into suspicious activity at an unnamed organization.
According to GreyNoise and BleepingComputer, the attacker got in through old, known flaws: CVE-2024-3272 and CVE-2024-3273 in D-Link ShareCenter NAS devices, CVE-2021-44228 (Log4Shell) in Ubiquiti UniFi Video recorders, and CVE-2025-31324 in SAP NetWeaver Visual Composer. They also appeared to target Hikvision and Dahua DVR and NVR recorders, though the exploited flaws there were not specified. In some cases they added their own SSH key to keep a backup way in. Pawns.app’s command-line builds take the username and device details at runtime, which GreyNoise says makes them easy to install on machines the operator does not own.
The harm goes beyond a slower connection. Traffic leaving through a hijacked device can get its IP address blocked or tied to activity the owner had nothing to do with, and GreyNoise notes that residential proxies help attackers evade checks such as impossible-travel login alerts.
How to check if you’re affected
Affected products are the D-Link ShareCenter NAS, Ubiquiti UniFi Video, SAP NetWeaver Visual Composer, and Hikvision and Dahua DVR/NVR devices that are reachable from the internet and have not been patched against the CVEs above. GreyNoise’s report lists no fixed versions, so use each vendor’s advisory.
- Look for software you did not install: a Pawns.app or IPRoyal process or binary on the device, and unfamiliar SSH keys in the authorized keys for any account.
- Remove internet exposure for NAS and recorder admin pages, and apply the latest firmware from the vendor. BleepingComputer’s advice is to keep NAS devices and recorders updated, use strong credentials and restrict network access.
- GreyNoise offers a free lookup (account required) to check whether your IP has interacted with its observation network, which it says is a potential sign of proxyjacking.
- Organizations should flag logins from residential proxy IP addresses, especially several staff signing in from the same one, and compare device and session identifiers rather than location alone.