Short answer: Security experts found that White House staff were using residential proxy services, making their internet addresses available for rent. This could pose security risks. Be cautious when using such services.
TL;DR
- White House staff used residential proxy services.
- These services allow renting an internet address.
- The services were from a Russian company.
- Activity was mainly in the evening.
What happened?
This incident involves White House staff using residential proxy services. These services let users rent an internet address to hide their location or anonymize web traffic. The specific Russian company involved was previously linked to cyberattacks in 2016. The activity was mostly noticed in the evenings, and the White House did not respond to inquiries.
Key facts
| Reported by | Krebs on Security |
|---|---|
| Date reported | 05 Nov 2026 |
How it works
Residential proxy services let users rent IP addresses to hide their location. Staff at the White House used these services, which can be bought for a few dollars.
- Staffers used residential proxy services.
- Proxies exited from White House network 236 times.
- Proxies used Windows 11 and Infatica software.
- Multiple proxy services were involved.
- Activity was detected by security firms.
Timeline
| Date | Event | Source |
|---|---|---|
| 2026-11-05 | Reported by Krebs on Security | Krebs on Security |
| 2026-11-11 | This Skillmate explainer published | Skillmate |
How to fix it
- Keep the operating system, browser and security software updated.
- Do not open unexpected attachments or install software from unofficial sources.
- Report suspicious files or pop-ups to your IT or security team.
How to detect it
Defenders should look for unexpected traffic from proxy services, multiple logins, and late-night activity.
Signs to watch for:
- Unknown programs starting at boot, or new scheduled tasks.
- Security software that was turned off without a reason.
- Unusual outbound connections from a workstation.
What is confirmed
- Reported by Krebs on Security
Why it matters
This matters because residential proxies can lead to security risks. Criminals can exploit vulnerabilities to gain access to sensitive networks. It highlights the need for better cybersecurity practices in government and corporate environments.
Learn the skills behind this story
Want to understand attacks like this and defend against them? Join Skillmate cybersecurity training or practise hands-on in Skillmate Labs.
FAQ
What are residential proxies?
Residential proxies use real home internet addresses, making it harder to trace the user. They can be used for good, like anonymizing browsing, or for bad, like cybercrime.
How can residential proxies be risky?
They can introduce security risks, as cybercriminals can probe local networks for vulnerabilities. These services are often anonymous, making it hard to track misuse.
Related Skillmate posts
Sources
- Want to Rent an Internet Address at the White House? (Krebs on Security)
How we wrote this: facts come from the sources above. An on-prem AI model drafted the plain-English parts and every sentence was checked against the sources; unsupported sentences were removed. MITRE mapping is our own judgement.
Watch today's video brief: https://youtu.be/yaK-CF987xg