Concerns Raised Over White House Staff Using Residential Proxy Services

5 November 2026 4 min read هدهد تك | Hudhud Tech

Security experts have raised alarms about several staffers at the White House using computers or mobile devices equipped with residential proxy services, which make their internet addresses available for others to rent. One of these proxy services is operated by a Russian company whose founder’s web hosting business was implicated in cyberattacks against election systems in Arizona and Illinois in 2016.

The security firm Layer3 Intel reported detecting multiple residential proxy nodes originating from the internet address network reserved for the Executive Office of the President (AS2650). Layer3 noted that proxy activity was consistently observed between October 5 and November 3, with a review indicating that proxies exited from the White House network 236 times during this period.

The proxy tracking company Synthient reported on Twitter/X that the activity detected from AS2650 was linked to multiple installations of a service called Infatica, a proxy program often integrated into “free” mobile and desktop applications. Infatica’s founder, Vladimir Fomenko, is a Russian national whose hosting firm King Servers was associated with six of the eight internet addresses used by Russia’s state security services to compromise databases for election systems in 2016.

Layer3 Intel found that the proxy exit nodes at the White House originated from six internet addresses on 26 of the 30 days analyzed, with most activity occurring in the evening between 5 p.m. and midnight.

Remarkably, Infatica was not the only proxy service reportedly reselling access to White House internet addresses. Layer3 Intel identified 28 separate residential proxy services capable of exiting through this network.

“This is public access,” the Layer3 Intel team stated. “Anyone can obtain it by signing up for a public residential proxy service, paying a few dollars, and sending requests through it. We did not selectively target this network or attempt to make our probes exit from it. We discovered this by chance, simply by requesting global rotating access through these services.”

The White House did not immediately respond to a request for comment.

Residential proxy services are known to be a significant source of unwanted and often malicious traffic, including account takeovers, advertising fraud, and mass content scraping for AI projects.

These services can also pose serious security risks. In late 2025, it was revealed that cybercriminals were exploiting a widespread vulnerability in these services, allowing them to probe each proxy endpoint’s local network for vulnerable systems to infect with malware. In January 2026, numerous proxy services were compelled to patch their networks after Synthient Founder Ben Brundage demonstrated how cybercriminals were abusing a vulnerability in these residential proxy services to gain control over devices within the local networks of unsuspecting users.

“Some of these resellers sell bandwidth for as low as 60 cents per gigabyte, which means for less than a dollar, you can gain access to some of the most confidential and trusted networks,” Brundage told KrebsOnSecurity. “The reseller ecosystem further enables this, allowing any criminal to buy access while bypassing KYC [Know Your Customer] processes.”

These proxy services are often found on employee devices brought into the workplace. App developers can incorporate software development kits (SDKs) provided by residential proxy networks to monetize their software, earning a small fee for each installation.

Despite the risks associated with residential proxies, they are frequently present on government and corporate networks. In a January 2026 webinar, the proxy tracking service Spur found residential proxies in nearly 300 government-owned and operated networks, 318 utility companies, 166 healthcare companies or hospitals, and 141 companies in banking and finance. Additionally, a blog post by the security firm Infoblox earlier this year revealed that 65% of its customer base was querying one or more residential proxy-related domains.