Proxyjacking

What Proxyjacking Is and How It Works

Proxyjacking is the unauthorised turning of a victim device into a relay point, so the attacker can route traffic through it, monetise its bandwidth, or hide the origin of their activity. It is usually low-visibility, which makes it easy to miss until network usage, performance, or abuse complaints expose it.

The core mechanic is simple: the device is enrolled into a proxy network or abused as an exit node, then instructed to forward traffic that the owner never intended to support. Because the device is acting as infrastructure rather than directly “infecting” files or stealing data, the compromise can stay hidden while still consuming resources and trust.

Why Proxyjacking Is Dangerous

Proxyjacking creates a trust and abuse problem, not just a performance problem. A compromised endpoint can be used to route malicious, fraudulent, or anonymous traffic, which can expose the device owner to investigation, throttling, reputation damage, or service-provider enforcement actions.

It is also dangerous because the relay role can blend into ordinary outbound traffic patterns. If the device is lightly monitored, the abuse may persist for long periods, especially on always-on systems, cloud hosts, or endpoints with excess bandwidth.

How Organisations Identify Exposure

Exposure begins with any device that has internet reachability, spare bandwidth, weak endpoint controls, or software that can be abused to install relay tooling. Asset inventory matters because proxyjacking often appears on systems that are forgotten, unmanaged, or not tied to a clear owner.

Useful checks include reviewing outbound traffic patterns, DNS and proxy logs, endpoint telemetry, and any vendor or security-advisory reporting linked to the software or service in use. NIST Cybersecurity Framework 2.0 is a useful way to organise that visibility work across identify, protect, detect, respond, and recover.

Prevention and Response for Proxyjacking

Prevention is mainly about reducing the opportunity to turn an endpoint into relay infrastructure. That means tightening software installation paths, limiting unnecessary outbound connectivity, restricting remote administration, and watching for tools or services that enable traffic forwarding without business need.

When proxyjacking is suspected, the response should treat the device as potentially abused infrastructure, not just a noisy host. NIST SP 800-53 Rev 5 Security and Privacy Controls provides a strong control basis for access control, logging, configuration management, and system integrity monitoring, while CIS Benchmarks help harden the underlying platform against abuse.

After removal, review whether the device was used only as a relay or whether the attacker also gained broader footholds, because proxyjacking can coexist with credential theft, remote access tooling, or additional persistence.

Risk and Threat Considerations

Proxyjacking is attractive to attackers because it converts someone else’s device into disposable infrastructure. That lets them hide source IPs, distribute traffic across many nodes, and generate revenue or cover activity while the victim absorbs the cost and operational noise.

Failure mechanism: The attacker gains execution or configuration control on the device, installs or enables proxy software, and then forces the host to forward traffic as a relay node while blending into normal network activity.

Impact: The victim can suffer bandwidth costs, degraded performance, abuse complaints, service throttling, and loss of trust in the device or network, especially if the relay is used for malicious or policy-violating traffic.

Practitioner Guidance

What to watch for: Treat unexplained outbound volume, unusual long-lived connections, or a device behaving like an internet relay as a signal for investigation. Proxyjacking is often discovered through indirect symptoms, so network and endpoint telemetry need to be correlated rather than reviewed in isolation.

Governance implication: Ownership of internet-facing endpoints matters, because unmanaged or orphaned devices are the easiest place for relay abuse to persist. If a host has no clear business role that justifies proxy-like behavior, that should be treated as a control exception, not a normal state.