Security researchers have discovered that someone on the White House network appears to be running software that allows outside users to rent access to the presidential network’s IP addresses for as little as a few dollars. The findings were reported by cybersecurity firms Layer3 Intel and Synthient and covered by Krebs on Security and The Register.
A residential proxy allows third parties to route their internet traffic through another user’s device, concealing where that activity actually originates. Apps and browser extensions sometimes include third-party software development kits (SDKs) that quietly install proxy nodes on a user’s device, which proxy services then sell access to — often without the user’s knowledge.
Layer3 Intel found that 28 residential proxy services routed traffic out of the White House network between October 5th and November 3rd, 2026, typically between 5PM and midnight ET. The firm said the timing pattern “suggests a person rather than a public guest Wi-Fi network: someone regularly on the White House network late into the evening, whose device is infected with a proxy SDK.” Synthient linked the activity to the watch party app Rave, which it says “bundles 12 proxy SDKs into the platform,” and identified “a number of Windows 10 and Windows 11 devices on the White House’s network beaconing to known proxy providers like Geonode, Infatica and Mellowtel.”
One of those providers carries additional concern: Infatica was founded by Vladimir Fomenko, owner of King Servers, which was previously linked to 2016 cyberattacks on election systems in Illinois and Arizona, according to Krebs on Security.
Layer3 Intel warned that the proxy access is “public,” meaning anyone can obtain it by signing up to a public residential proxy service and paying a small fee. While residential proxies have legitimate uses — such as ad verification and quality assurance testing — they can also be used to bypass geolocation controls and defensive filters, and have been used in botnet creation and account takeover attacks.
Source: The Verge