PanicStation.org
UK USA
uk Technology & digital loss unexpected proxy • proxy server suddenly enabled • computer using unknown proxy • web traffic routed through proxy • browser redirect through proxy • system proxy settings changed • windows proxy turned on • mac proxy settings changed • vpn i did not install • unknown network configuration • possible malware proxy • suspicious internet connection • device may be managed • proxy auto configuration pac file • automatic proxy setup enabled • setup script i dont recognise • credentials at risk online • sign-ins from new device • public wi-fi tampering concern • work laptop proxy enforced

What to do if…
your computer suddenly routes web traffic through a proxy you did not set

Short answer

Disconnect from the internet, then disable any unexpected proxy or automatic proxy setup before you sign in anywhere again.

Do not do these things

  • Don’t keep browsing “to see what happens” or log into banking, email, or work accounts while the proxy is active.
  • Don’t install random “proxy remover” tools or browser extensions suggested by pop-ups or unknown sites.
  • Don’t change settings on a work/school device if you’re not authorised—contact your IT/admin route instead.
  • Don’t wipe/reset the computer yet if you may need IT support, insurance documentation, or a report (secure accounts first).

What to do now

  1. Get to a safer pause and disconnect.
    Turn off Wi-Fi and unplug Ethernet. This stops more traffic being routed through the proxy while you check settings.

  2. Work/school device? Pause and report it to the right place.
    If it’s managed by your employer/school, contact your IT/helpdesk and say: “A proxy was enabled that I didn’t set.” Ask if your device is managed and whether a proxy/PAC script is expected.

  3. Check and disable “automatic proxy setup” / PAC script settings (the easy-to-miss one).
    Look for options like Automatic proxy setup, configuration script, Use setup script, Auto proxy discovery, or PAC.

    • On Windows, this is typically under Settings → Network & internet → Proxy.
    • On Mac, this is typically under System Settings → Network → (your connection) → Proxies.
      If anything is enabled with an address you don’t recognise, turn it off and take a screenshot/photo of what it was.

  4. Then check and disable any manually set proxy server.
    If you see a proxy server address/port you didn’t set, disable it and record the details (screenshot/photo).

  5. Restart, then confirm the proxy stayed off.
    If it turns itself back on after reboot, treat this as a strong sign of malware or unwanted remote management. Disconnect again and move to account security + scanning.

  6. From a different, trusted device, secure your most important accounts (email first).
    Using a phone/other computer you trust (on a known network):

    • Change your email password first (it controls password resets).
    • Enable two-step verification where possible.
    • Review recent sign-ins/devices and sign out other sessions if the service offers it.
      Then do the same for banking, password manager, and any account linked to money.

  7. Run reputable security checks and update the system.
    Run a full scan using built-in security and a reputable anti-malware scanner from the vendor’s official source. Install pending OS/browser updates and restart.

  8. If you suspect fraud/cybercrime, report it using the UK route that applies.

    • England, Wales, Northern Ireland: report to Report Fraud (online or by phone).
    • Scotland: report to Police Scotland (101 / online reporting).
      If the crime is occurring now, call 999. If you’re an organisation under a cyber attack, use the urgent phone route listed by Report Fraud.

What can wait

  • You don’t have to work out who did it or exactly how it happened right now.
  • You don’t need to factory reset immediately—start with disabling the proxy, securing accounts, and scanning.
  • You don’t have to contact every service today—prioritise email and anything tied to money or account recovery.

Important reassurance

An unexpected proxy setting is alarming, but the most protective actions are straightforward: stop the connection, remove the proxy, secure accounts from a clean device, and scan. You don’t need certainty about the cause to reduce harm quickly.

Scope note

These are first steps only. If the proxy reappears, if this is a managed device, or if accounts were accessed, you may need specialist IT help and/or to make a formal report.

Important note

This is general information, not professional cybersecurity or legal advice. If you’re unsure whether a proxy is expected (especially on work/school devices), pause changes and use the official support route for that device.

Additional Resources
Support us