home.social

#cryptojacking — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #cryptojacking, aggregated by home.social.

  1. From poisoned search results to GPU mining: A cryptojacking campaign abusing ScreenConnect and Microsoft .NET utilities

    Microsoft Defender Experts identified an active cryptojacking campaign leveraging AI-assisted delivery mechanisms alongside traditional SEO poisoning. Attackers create fake download sites impersonating trusted utilities like CrystalDiskInfo, HWMonitor, and FurMark, targeting users with high-performance GPUs. Victims download ZIP archives containing legitimate executables bundled with malicious DLLs that establish persistence via ScreenConnect remote access tools. The operation employs sophisticated techniques including DLL sideloading, process hollowing into Microsoft-signed .NET binaries, and comprehensive defense evasion. Beyond cryptocurrency mining, the campaign establishes persistent remote access that could enable data theft, lateral movement, or ransomware deployment. The threat actors deliberately target PC enthusiasts and hardware-focused users most likely to own discrete GPUs suitable for profitable mining operations.

    Pulse ID: 6a1634fbefeffa7f0c6a52f5
    Pulse Link: otx.alienvault.com/pulse/6a163
    Pulse Author: AlienVault
    Created: 2026-05-27 00:04:11

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CryptoJacking #CyberSecurity #DataTheft #InfoSec #Microsoft #MicrosoftDefender #NET #OTX #OpenThreatExchange #RAT #RansomWare #Rust #SEOPoisoning #SMS #ScreenConnect #SideLoading #ZIP #bot #cryptocurrency #AlienVault

  2. From poisoned search results to GPU mining: A cryptojacking campaign abusing ScreenConnect and Microsoft .NET utilities

    Microsoft Defender Experts identified an active cryptojacking campaign leveraging AI-assisted delivery mechanisms alongside traditional SEO poisoning. Attackers create fake download sites impersonating trusted utilities like CrystalDiskInfo, HWMonitor, and FurMark, targeting users with high-performance GPUs. Victims download ZIP archives containing legitimate executables bundled with malicious DLLs that establish persistence via ScreenConnect remote access tools. The operation employs sophisticated techniques including DLL sideloading, process hollowing into Microsoft-signed .NET binaries, and comprehensive defense evasion. Beyond cryptocurrency mining, the campaign establishes persistent remote access that could enable data theft, lateral movement, or ransomware deployment. The threat actors deliberately target PC enthusiasts and hardware-focused users most likely to own discrete GPUs suitable for profitable mining operations.

    Pulse ID: 6a1634fbefeffa7f0c6a52f5
    Pulse Link: otx.alienvault.com/pulse/6a163
    Pulse Author: AlienVault
    Created: 2026-05-27 00:04:11

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CryptoJacking #CyberSecurity #DataTheft #InfoSec #Microsoft #MicrosoftDefender #NET #OTX #OpenThreatExchange #RAT #RansomWare #Rust #SEOPoisoning #SMS #ScreenConnect #SideLoading #ZIP #bot #cryptocurrency #AlienVault

  3. From poisoned search results to GPU mining: A cryptojacking campaign abusing ScreenConnect and Microsoft .NET utilities

    Microsoft Defender Experts identified an active cryptojacking campaign leveraging AI-assisted delivery mechanisms alongside traditional SEO poisoning. Attackers create fake download sites impersonating trusted utilities like CrystalDiskInfo, HWMonitor, and FurMark, targeting users with high-performance GPUs. Victims download ZIP archives containing legitimate executables bundled with malicious DLLs that establish persistence via ScreenConnect remote access tools. The operation employs sophisticated techniques including DLL sideloading, process hollowing into Microsoft-signed .NET binaries, and comprehensive defense evasion. Beyond cryptocurrency mining, the campaign establishes persistent remote access that could enable data theft, lateral movement, or ransomware deployment. The threat actors deliberately target PC enthusiasts and hardware-focused users most likely to own discrete GPUs suitable for profitable mining operations.

    Pulse ID: 6a1634fbefeffa7f0c6a52f5
    Pulse Link: otx.alienvault.com/pulse/6a163
    Pulse Author: AlienVault
    Created: 2026-05-27 00:04:11

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CryptoJacking #CyberSecurity #DataTheft #InfoSec #Microsoft #MicrosoftDefender #NET #OTX #OpenThreatExchange #RAT #RansomWare #Rust #SEOPoisoning #SMS #ScreenConnect #SideLoading #ZIP #bot #cryptocurrency #AlienVault

  4. From poisoned search results to GPU mining: A cryptojacking campaign abusing ScreenConnect and Microsoft .NET utilities

    Microsoft Defender Experts identified an active cryptojacking campaign leveraging AI-assisted delivery mechanisms alongside traditional SEO poisoning. Attackers create fake download sites impersonating trusted utilities like CrystalDiskInfo, HWMonitor, and FurMark, targeting users with high-performance GPUs. Victims download ZIP archives containing legitimate executables bundled with malicious DLLs that establish persistence via ScreenConnect remote access tools. The operation employs sophisticated techniques including DLL sideloading, process hollowing into Microsoft-signed .NET binaries, and comprehensive defense evasion. Beyond cryptocurrency mining, the campaign establishes persistent remote access that could enable data theft, lateral movement, or ransomware deployment. The threat actors deliberately target PC enthusiasts and hardware-focused users most likely to own discrete GPUs suitable for profitable mining operations.

    Pulse ID: 6a1634fbefeffa7f0c6a52f5
    Pulse Link: otx.alienvault.com/pulse/6a163
    Pulse Author: AlienVault
    Created: 2026-05-27 00:04:11

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CryptoJacking #CyberSecurity #DataTheft #InfoSec #Microsoft #MicrosoftDefender #NET #OTX #OpenThreatExchange #RAT #RansomWare #Rust #SEOPoisoning #SMS #ScreenConnect #SideLoading #ZIP #bot #cryptocurrency #AlienVault

  5. From poisoned search results to GPU mining: A cryptojacking campaign abusing ScreenConnect and Microsoft .NET utilities

    Microsoft Defender Experts identified an active cryptojacking campaign leveraging AI-assisted delivery mechanisms alongside traditional SEO poisoning. Attackers create fake download sites impersonating trusted utilities like CrystalDiskInfo, HWMonitor, and FurMark, targeting users with high-performance GPUs. Victims download ZIP archives containing legitimate executables bundled with malicious DLLs that establish persistence via ScreenConnect remote access tools. The operation employs sophisticated techniques including DLL sideloading, process hollowing into Microsoft-signed .NET binaries, and comprehensive defense evasion. Beyond cryptocurrency mining, the campaign establishes persistent remote access that could enable data theft, lateral movement, or ransomware deployment. The threat actors deliberately target PC enthusiasts and hardware-focused users most likely to own discrete GPUs suitable for profitable mining operations.

    Pulse ID: 6a1634fbefeffa7f0c6a52f5
    Pulse Link: otx.alienvault.com/pulse/6a163
    Pulse Author: AlienVault
    Created: 2026-05-27 00:04:11

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CryptoJacking #CyberSecurity #DataTheft #InfoSec #Microsoft #MicrosoftDefender #NET #OTX #OpenThreatExchange #RAT #RansomWare #Rust #SEOPoisoning #SMS #ScreenConnect #SideLoading #ZIP #bot #cryptocurrency #AlienVault

  6. DDoS-for-Hire Operation Exposed: How an Operator's Debug Build Unraveled a Commercial Game-Server Botnet

    An exposed open directory on a Netherlands-hosted server revealed the complete operational toolkit of xlabs_v1, a Mirai-derived IoT botnet operated by an actor using the handle Tadashi. The operation provides DDoS-for-hire services specifically targeting game servers and Minecraft hosts through 21 distinct flood attack variants. The botnet exploits Android Debug Bridge (ADB) on TCP/5555 to compromise over 4 million potentially vulnerable IoT devices including Android TV boxes, smart TVs, and routers. The operation features bandwidth profiling to price-tier infected devices, ChaCha20 string encryption with cryptographic weaknesses, and competitor-eradication routines. Infrastructure analysis consolidated the entire operation within a single bulletproof /24 netblock in the Netherlands, with co-located cryptojacking infrastructure also identified.

    Pulse ID: 69f25f09e5c3a33611f7cb16
    Pulse Link: otx.alienvault.com/pulse/69f25
    Pulse Author: AlienVault
    Created: 2026-04-29 19:42:01

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Android #ChaCha20 #CryptoJacking #CyberSecurity #DDoS #DoS #Encryption #InfoSec #IoT #Minecraft #Mirai #OTX #OpenThreatExchange #RAT #TCP #TheNetherlands #bot #botnet #AlienVault

  7. DDoS-for-Hire Operation Exposed: How an Operator's Debug Build Unraveled a Commercial Game-Server Botnet

    An exposed open directory on a Netherlands-hosted server revealed the complete operational toolkit of xlabs_v1, a Mirai-derived IoT botnet operated by an actor using the handle Tadashi. The operation provides DDoS-for-hire services specifically targeting game servers and Minecraft hosts through 21 distinct flood attack variants. The botnet exploits Android Debug Bridge (ADB) on TCP/5555 to compromise over 4 million potentially vulnerable IoT devices including Android TV boxes, smart TVs, and routers. The operation features bandwidth profiling to price-tier infected devices, ChaCha20 string encryption with cryptographic weaknesses, and competitor-eradication routines. Infrastructure analysis consolidated the entire operation within a single bulletproof /24 netblock in the Netherlands, with co-located cryptojacking infrastructure also identified.

    Pulse ID: 69f25f09e5c3a33611f7cb16
    Pulse Link: otx.alienvault.com/pulse/69f25
    Pulse Author: AlienVault
    Created: 2026-04-29 19:42:01

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Android #ChaCha20 #CryptoJacking #CyberSecurity #DDoS #DoS #Encryption #InfoSec #IoT #Minecraft #Mirai #OTX #OpenThreatExchange #RAT #TCP #TheNetherlands #bot #botnet #AlienVault

  8. DDoS-for-Hire Operation Exposed: How an Operator's Debug Build Unraveled a Commercial Game-Server Botnet

    An exposed open directory on a Netherlands-hosted server revealed the complete operational toolkit of xlabs_v1, a Mirai-derived IoT botnet operated by an actor using the handle Tadashi. The operation provides DDoS-for-hire services specifically targeting game servers and Minecraft hosts through 21 distinct flood attack variants. The botnet exploits Android Debug Bridge (ADB) on TCP/5555 to compromise over 4 million potentially vulnerable IoT devices including Android TV boxes, smart TVs, and routers. The operation features bandwidth profiling to price-tier infected devices, ChaCha20 string encryption with cryptographic weaknesses, and competitor-eradication routines. Infrastructure analysis consolidated the entire operation within a single bulletproof /24 netblock in the Netherlands, with co-located cryptojacking infrastructure also identified.

    Pulse ID: 69f25f09e5c3a33611f7cb16
    Pulse Link: otx.alienvault.com/pulse/69f25
    Pulse Author: AlienVault
    Created: 2026-04-29 19:42:01

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Android #ChaCha20 #CryptoJacking #CyberSecurity #DDoS #DoS #Encryption #InfoSec #IoT #Minecraft #Mirai #OTX #OpenThreatExchange #RAT #TCP #TheNetherlands #bot #botnet #AlienVault

  9. DDoS-for-Hire Operation Exposed: How an Operator's Debug Build Unraveled a Commercial Game-Server Botnet

    An exposed open directory on a Netherlands-hosted server revealed the complete operational toolkit of xlabs_v1, a Mirai-derived IoT botnet operated by an actor using the handle Tadashi. The operation provides DDoS-for-hire services specifically targeting game servers and Minecraft hosts through 21 distinct flood attack variants. The botnet exploits Android Debug Bridge (ADB) on TCP/5555 to compromise over 4 million potentially vulnerable IoT devices including Android TV boxes, smart TVs, and routers. The operation features bandwidth profiling to price-tier infected devices, ChaCha20 string encryption with cryptographic weaknesses, and competitor-eradication routines. Infrastructure analysis consolidated the entire operation within a single bulletproof /24 netblock in the Netherlands, with co-located cryptojacking infrastructure also identified.

    Pulse ID: 69f25f09e5c3a33611f7cb16
    Pulse Link: otx.alienvault.com/pulse/69f25
    Pulse Author: AlienVault
    Created: 2026-04-29 19:42:01

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Android #ChaCha20 #CryptoJacking #CyberSecurity #DDoS #DoS #Encryption #InfoSec #IoT #Minecraft #Mirai #OTX #OpenThreatExchange #RAT #TCP #TheNetherlands #bot #botnet #AlienVault

  10. DDoS-for-Hire Operation Exposed: How an Operator's Debug Build Unraveled a Commercial Game-Server Botnet

    An exposed open directory on a Netherlands-hosted server revealed the complete operational toolkit of xlabs_v1, a Mirai-derived IoT botnet operated by an actor using the handle Tadashi. The operation provides DDoS-for-hire services specifically targeting game servers and Minecraft hosts through 21 distinct flood attack variants. The botnet exploits Android Debug Bridge (ADB) on TCP/5555 to compromise over 4 million potentially vulnerable IoT devices including Android TV boxes, smart TVs, and routers. The operation features bandwidth profiling to price-tier infected devices, ChaCha20 string encryption with cryptographic weaknesses, and competitor-eradication routines. Infrastructure analysis consolidated the entire operation within a single bulletproof /24 netblock in the Netherlands, with co-located cryptojacking infrastructure also identified.

    Pulse ID: 69f25f09e5c3a33611f7cb16
    Pulse Link: otx.alienvault.com/pulse/69f25
    Pulse Author: AlienVault
    Created: 2026-04-29 19:42:01

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Android #ChaCha20 #CryptoJacking #CyberSecurity #DDoS #DoS #Encryption #InfoSec #IoT #Minecraft #Mirai #OTX #OpenThreatExchange #RAT #TCP #TheNetherlands #bot #botnet #AlienVault

  11. @sirfharu I reported that coinbase (crypto spam) and blocked as well my end. The one in your neighbourhood post.
    When did mastodon start to have these spammers? No place they seem to have spared.
    #banspam #cryptojacking #spam
    @masto.social

  12. Hackers are hijacking corporate #XWiki servers using flaw CVE-2025-24893 to install cryptominers and gain full server access. Patch now. 🔒

    Read: hackread.com/hackers-hijack-xw

    #CyberSecurity #RCE #Cryptojacking #XWiki #InfoSec

  13. ⚠️ LunoBotnet: A modular Linux botnet with cryptomining + DDoS-for-hire.
    ✔️ Self-healing watchdogs
    ✔️ System binary replacement
    ✔️ Targets Roblox, Minecraft, Valve
    ✔️ Markets services via Telegram
    Experts call it a criminal infrastructure platform for long-term monetization.

    💬 How do you rate the detection difficulty here? Follow @technadu for analysis.

    #Cyble #LunoBotnet #LinuxMalware #Cryptojacking #DDoS #Botnet #SelfHealing #Malware #CyberThreatIntel

  14. ⚠️ LunoBotnet: A modular Linux botnet with cryptomining + DDoS-for-hire.
    ✔️ Self-healing watchdogs
    ✔️ System binary replacement
    ✔️ Targets Roblox, Minecraft, Valve
    ✔️ Markets services via Telegram
    Experts call it a criminal infrastructure platform for long-term monetization.

    💬 How do you rate the detection difficulty here? Follow @technadu for analysis.

    #Cyble #LunoBotnet #LinuxMalware #Cryptojacking #DDoS #Botnet #SelfHealing #Malware #CyberThreatIntel

  15. Crypto influencer sentenced for multi-million dollar scheme

    The U.S. District Court for the Eastern District of New York in Brooklyn. Brooklyn Eagle photo by Rob…
    #NewsBeep #News #US #USA #UnitedStates #UnitedStatesOfAmerica #Computing #CryptoFraud #cryptocurrency #cryptojacking #DailyBulletin #EasternDistrictofNewYork #JosephNocella #sentencing #Technology #TheLegalAidSociety #U.S.DistrictCourtfortheEasternDistrictofNewYork(EDNY)
    newsbeep.com/us/101313/

  16. Tom’s Hardware: Hacker plants three strains of malware in a Steam Early Access game called Chemia — security company found crypto-jacking infostealers and a backdoor to install yet more malware in the future. “A cyber threat intelligence firm called Prodaft revealed that ‘Chemia,’ a game previously available via Steam’s Early Access program, shipped with three strains of malware.”

    https://rbfirehose.com/2025/07/31/toms-hardware-hacker-plants-three-strains-of-malware-in-a-steam-early-access-game-called-chemia-security-company-found-crypto-jacking-infostealers-and-a-backdoor-to-install-yet-more-malwa/