GhostSocks Malware-as-a-Service Turns Compromised Devices into Proxies for Threat Actors

On October 15, 2023, a threat actor using the handle GhostSocks published a sales post on the Russian cybercrime forum xss[.]is advertising a novel Malware-as-a-Service. The service is designed to turn compromised Windows machines into residential SOCKS5 proxies, allowing cybercriminals to bypass anti-fraud defences and monetise infected hosts, with a management panel showing build creation, proxy assignment and real-time status monitoring.

GhostSocks is distributed as a 32‑bit DLL or a standalone executable, both authored in Go and obfuscated using the open-source garble project, and it decrypts a list of defanged C2 URLs to establish a connection before spawning a bi-directional SOCKS5 tunnel via the go-socks5 and yamux libraries.

In February 2025, leaked BlackBasta chat logs revealed the gang’s discussion of using GhostSocks alongside Lumma Stealer to maintain prolonged access after initial compromise, and adoption surged in February 2024 following a partnership with Lumma Stealer that allowed affiliate users to install GhostSocks automatically.

While law enforcement disrupted Lumma Stealer infrastructure later in 2025, GhostSocks continues to be developed and sold, with prices as low as $0.50 per device per day, according to Synthient research repository.