Superproxy How Residential Proxy Networks Have Become Malware Delivery Platforms

www.plume.com • September 4, 2026

In Part 1 of Plume’s SuperProxy research series, the Plume Security Lab uncovered how SuperBox streaming devices silently enrolled users into residential proxy networks through bundled applications, allowing attackers to monetize internet connections without user knowledge.

Part 2 reveals the stage of the threat.

Our researchers found that these residential proxy networks are not simply monetization tools. They are also used as targets for additional malware delivery, enabling cybercriminals to infect already-compromised devices with entirely new malware families while remaining largely invisible to the device owner.

The Plume Security Lab conducted this research through reverse engineering, infrastructure analysis, controlled experiments, and live traffic monitoring of residential proxy activity observed on SuperBox streaming devices. The findings build on the first installment of the SuperProxy research series and continue Plume’s work exposing threats affecting connected homes worldwide.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SuperBox Devices Compromise Home Networks for Cybercrime Research reveals that SuperBox streaming devices can enroll users into residential proxy networks without their knowledge, allowing cybercriminals to route illicit traffic through compromised home networks. The FBI defines residential proxies as intermediaries that mask users' identities, making them appear responsible for activities initiated by attackers. This issue is exacerbated by the devices' configurations, which disable Android security safeguards, exposing them to malware delivery. Law enforcement warns that these proxy networks can facilitate various cybercrimes, including credential stuffing and account abuse. The Plume Security Lab's findings indicate that these devices not only serve as exit nodes for criminal activities but can also be targeted for additional malware installations. Users of affected devices are at risk of having their internet connections exploited for malicious purposes. 1 sources 52

Superproxy How Residential Proxy Networks Have Become Malware Delivery Platforms

The full story

Extracted Entities

Attack Types (1)

Platforms (1)