Lurking Lizard is a China-based threat actor operating an end-to-end malicious residential proxy business since at least August 2022. The actor uses over 230 lookalike domains, trojanized installers (e.g., fake 7-Zip), and drop-catching to recruit devices into a proxy botnet, monetized through impersonated proxy brands and fake review sites.