CampaignPublished 26 May 2026

From poisoned search results to GPU mining: A cryptojacking campaign abusing ScreenConnect and Microsoft .NET utilities

Source Microsoft Security Blog

Description

Microsoft exposes a cryptojacking campaign using SEO poisoning and ScreenConnect to target high-performance PCs, with malicious sites also surfaced through AI chatbots. The post From poisoned search results to GPU mining: A cryptojacking campaign abusing ScreenConnect and Microsoft .NET utilities appeared first on Microsoft Security Blog .

Impact

The campaign results in unauthorized cryptocurrency mining on targeted high-performance PCs, which can degrade system performance and increase power consumption. It abuses legitimate software tools (ScreenConnect and Microsoft .NET utilities), complicating detection and mitigation. There is no evidence of data theft or system destruction reported. No known exploits in the wild have been confirmed, but the campaign's use of SEO poisoning and AI chatbot manipulation increases its potential reach.

Defensive guidance

No specific patches or fixes are identified in the provided information. Users and administrators should remain vigilant about search results and links surfaced by AI chatbots, especially those related to ScreenConnect and .NET utilities. Employing endpoint protection solutions capable of detecting cryptojacking behavior and monitoring for unusual GPU usage may help mitigate risk. Since this campaign abuses legitimate software, reviewing and restricting the use of remote access tools like ScreenConnect and ensuring .NET utilities are used securely is advisable.

Summary

This campaign uses SEO poisoning to direct victims to malicious websites that exploit ScreenConnect (a remote access tool) and Microsoft .NET utilities to deploy cryptojacking malware. The attackers abuse legitimate software components to mine cryptocurrency on compromised high-performance PCs, increasing stealth and persistence. The campaign also leverages AI chatbots to surface malicious links, expanding its reach. The technical details are documented in a Microsoft Security Blog article, but no specific vulnerabilities or patches are mentioned. The threat is categorized as high severity due to its impact on system resources and potential unauthorized use of computing power.

References

microsoft.com/en-us/security/blog/2026/05/26/poisoned-search-results-gpu-mining-cryptojacking-campaign-abusing-screenconnect-microsoft-net-utilities/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 27 May 2026, 22:05 UTC

References

Community reviews