Quick Summary
A trojanized version of the 7-Zip software is infecting home computers, turning them into residential proxy nodes. Malwarebytes discovered this after a Reddit user reported malware from downloading 7-Zip from 7zip.com instead of the legitimate 7-zip.org. The malware not only mimics 7-Zip but also drops additional payloads, allowing third parties to route traffic through the victim’s IP address, raising significant cybersecurity concerns.
The Securityish Brief
Malwarebytes has identified a trojanized version of the popular file compression tool 7-Zip that is compromising home computers. This malware, which was discovered following a Reddit user’s complaint about downloading from 7zip.com instead of the official 7-zip.org, functions as a proxyware. It allows unauthorized third parties to use infected systems as residential proxy nodes, routing traffic through the victim’s IP address.
The malware employs various evasion techniques to avoid detection, such as checking for signs of analysis or monitoring before executing. Stefan Dasic, a manager at Malwarebytes, emphasized that any system that has run installers from 7zip.com should be regarded as compromised.
This incident highlights a broader issue where users may inadvertently download malicious software due to misleading links in online content, such as YouTube tutorials. Attackers exploit these small errors to direct victims to malicious sites, showcasing how easily malware can spread.
Implications for Users and Organizations
End users must exercise caution when downloading software, ensuring they verify sources and bookmark official project domains. Unexpected code-signing identities should be treated with skepticism. Organizations should also be vigilant, monitoring for unauthorized Windows services and changes to firewall rules.
Malwarebytes linked this trojanized software to a larger proxyware distribution operation, identifying related binaries associated with popular services like Hola, TikTok, WhatsApp, and Wire. This connection underscores the importance of understanding how malware can be interconnected and the potential risks of using compromised software.
Key Takeaways
- Always download software from official websites to avoid malicious versions.
- Verify the source of any software before installation, especially if recommended by online tutorials.
- Monitor your system for unauthorized services and firewall rule changes.
- Be cautious of unexpected code-signing identities during software installation.
- Bookmark official project domains to prevent falling for phishing attempts.
Key Terms & Concepts
- Proxyware: In this article, proxyware refers to malware that turns infected systems into proxy nodes for unauthorized traffic routing.
- Payload: In this context, a payload refers to the additional malicious software dropped onto a system by the trojanized installer.
- Code-signing: Code-signing is a security measure that verifies the authenticity of software to ensure it has not been altered.
Read the original article here: https://www.helpnetsecurity.com/2026/02/10/trojanized-7-zip-software-malware-distribution/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
