This is my security story of the day, and it's one of those headlines that sounds like a joke until you think about what it means for your own network.
Researchers say that for about a month, anyone with a few dollars and an account at a residential proxy service could have had their traffic come out of the network registered to the Executive Office of the President.
What Was Reported
Layer3 Intel, which runs a residential proxy observatory, said it noticed this by accident while buying rotating proxy access the way any customer would and logging where requests exited. Per Ipregistry's write-up of Layer3's findings:
- 236 exits through six IP addresses on AS2650, the network registered to the Executive Office of the President, between October 5 and November 3, on 26 of those 30 days.
- The exits were available through 28 different residential proxy services.
- About half of them landed in the evening, Eastern time.
Synthient, another research firm, said it believes the traffic traces to a Windows 11 machine running a proxy SDK, possibly bundled inside a shared streaming app. That part hasn't been shown publicly, and the reports don't agree on which SDK it was.
What Nobody Has Shown
I want to be careful here, because the internet won't be. Ipregistry put it plainly: "Nobody has shown that a White House system was compromised, and Layer3 does not claim it." What the data shows is that something behind those addresses was running proxy software. Six IPs behind an office NAT can be one device or a few hundred. I haven't seen an official statement on it.
So this isn't "the White House got hacked." It's "a device on a very sensitive network was quietly selling its connection to strangers." Which is bad enough.
Why This Is Everybody's Problem
Residential proxy SDKs get bundled into free apps, browser extensions, cheap streaming boxes and "earn passive income" tools. Somebody installs one on a laptop that lives on the corporate network, and now your egress IP is for sale.
Two things follow from that, and both are Zero Trust arguments:
1. Your IP address is not your identity. If any of your controls say "trust it because it came from our office range" or "trust it because it's a government/business ASN," this story should end that. Attackers rent clean, reputable IPs precisely because so many fraud and access checks still treat network location as a credential. Ipregistry's own advice was to stop relying on network-type labels like "government" and to check proxy signals at the moment of the sensitive action.
2. A proxy SDK is an inbound door, not just outbound traffic. Layer3 pointed out that poorly secured proxy SDKs have allowed access into internal networks. If a stranger's traffic is coming out of a device on your LAN, ask what else can come in through the same pipe. On a flat network, that device is a stepping stone.
The architecture fix is the boring one: decide access on identity, device posture and the specific app, not on which subnet a packet came from, and don't let user devices sit on a network where they can reach everything. (I work at Zscaler, so yes, this is the thing we sell. It's also just what Zero Trust means, whoever you buy it from.)
What To Do
- Look for your own egress IPs in residential proxy feeds. If your NAT addresses show up, you have a device to find.
- Hunt for proxy SDKs. Search DNS and proxy logs for known residential proxy SDK domains, and inventory "free" apps, extensions and streaming tools on managed endpoints.
- Stop granting trust by IP range. Office-IP allowlists on SaaS, admin consoles and VPN bypass rules are exactly what these services monetize.
- Segment user devices away from servers and admin interfaces, so one bad app on one laptop doesn't become a tunnel into everything.
- Use step-up checks (MFA, holds, review) for sensitive actions instead of trusting a "good" network label.
Bottom Line
If the most scrutinized network in the country can end up in a proxy pool, yours can too. The lesson isn't about the White House. It's that "it came from a trusted IP" was never a security control.
Sources: Ipregistry, CSO Online, Cybernews