GhostSocks Malware: A Growing Threat Utilizing Residential Proxies

• •GhostSocks malware turns compromised devices into residential proxies, evading detection.
• •It has been linked to the Lumma Stealer, enhancing its operational capabilities.
• •Darktrace has observed a significant increase in GhostSocks incidents since late 2025.

GhostSocks is a malware that transforms compromised devices into residential proxies, enabling attackers to bypass IP detection tools. Originally marketed as Malware-as-a-Service on a Russian underground forum, it gained notoriety for its ability to blend malicious traffic with normal activity. The malware operates using the SOCKS5 proxy protocol and employs TLS encryption to conceal its communications. Its partnership with Lumma Stealer in 2024 significantly increased its adoption among threat actors. Darktrace has reported a rise in GhostSocks activity since late 2025, with multiple incidents detected across various sectors, including education. The malware also has backdoor capabilities, allowing attackers to execute commands and deploy additional payloads. Notably, ransomware group Black Basta has utilized GhostSocks for maintaining long-term access to victim networks. The current status indicates ongoing activity and a persistent threat to organizations.