Several computers or mobile devices used by White House staff are running residential proxy services that let anyone rent their internet address, security researchers warned. Layer3 Intel detected proxy exit nodes in the address block reserved for the Executive Office of the President (AS2650): between October 5 and November 3, traffic exited through it 236 times, from six addresses, on 26 of 30 days, mostly in the evening.
According to Layer3 Intel, 28 different proxy services were able to exit through this network. Synthient tied some of the activity to several Windows 11 installations of a service called Infatica, a proxy program often bundled into "free" apps. Infatica's founder is a Russian whose hosting company was used in 2016 to attack election system databases in Arizona and Illinois.
Residential proxy services are used for account takeovers, ad fraud and content scraping, among other things, and let a customer appear to be browsing from inside the victim's network. They usually arrive through software development kits that app developers embed to earn money on each install.
The White House did not immediately respond. Organizations can check their own networks for such traffic and restrict the installation of unapproved free apps on work devices.