Multiple vulnerabilities in Plex Media Server version 1.43.2 and earlier are actively exploited in the wild to achieve remote code execution. Attackers chain four CVEs to deploy the XMRig cryptominer and a proxy tool named myawesomeproxy. Exploitation attempts began on October 17, 2026, with malicious payloads downloaded from known IP addresses. The proxy software may enable threat actors to use residential IPs to access corporate VPNs and email systems. Public proof-of-concept exploit code is available via the plex2shell project. No official patch or remediation information is currently provided.
A threat actor exploited a path traversal vulnerability (CVE-2025-4632) in Samsung MagicINFO 9 Server to gain unauthorized access to endpoints. They deployed a rogue AnyDesk remote access tool, created a local administrator account, and disabled Microsoft Defender protections. Instead of deploying a pre-compiled cryptominer, the actor compiled a Monero cryptominer directly on the compromised endpoint using multiple compilers and utilities. The miner connected to the C3Pool mining service and ran under explorer.exe with suspicious arguments. This on-endpoint compilation generated significant endpoint detection and response (EDR) telemetry, increasing detectability despite attempts at stealth.
A security researcher gained unauthorized access to a server involved in distributing a modular malware campaign targeting Brazilian users. The malware includes a Trojan with keylogging, desktop capture, shellcode injection, a cryptominer, and a Tor-based command and control infrastructure. The infection chain uses multiple payload layers designed to maintain persistence even if one stage is disrupted. The researcher published a detailed report describing the infection chain and malware components.
Threat actors are actively exploiting AI distribution platforms like Hugging Face and ClawHub to deliver malware by embedding malicious code within models, datasets, and agent extensions. Over 575 malicious skills across 13 developer accounts were identified in the OpenClaw ecosystem, targeting Windows and macOS with trojans, cryptominers, and AMOS stealer. Attackers abuse trust relationships between users and AI platforms through indirect prompt injection, where hidden instructions cause AI agents to execute malicious actions on behalf of users. Trojanized skills masquerade as legitimate tools while instructing users to execute encoded commands or install hidden malicious dependencies. On Hugging Face, repositories host payloads within multistep infection chains disguised as legitimate applications. These campaigns employ social engineering, obfuscation, encryption, in-memory execution, process injection, and persistence techniques to evade detection while establishing covert command-and-control communica...
A persistent nine-month RondoDoX botnet campaign has been targeting IoT devices and web applications. The threat actors have recently shifted to weaponizing a critical Next.js vulnerability, deploying malicious payloads like 'React2Shell' and cryptominers. The campaign, spanning from March to December 2025, shows quick adaptation to latest attack trends. The activity is divided into three phases: initial reconnaissance, web application exploitation, and IoT botnet deployment. The attackers have been using multiple command and control servers and deploying various malware variants. The campaign has intensified in December 2025 with a focus on Next.js exploitation. The impact includes widespread IoT device compromise, Next.js application risks, credential harvesting, and persistent multi-architecture threats.
RedTail cryptominer malware has been observed targeting exposed Docker APIs on port 2375/tcp, marking a new evolution in its attack surface. Previously known for exploiting PHP vulnerabilities, PAN-OS, and Ivanti products, this is the first public evidence of RedTail leveraging unsecured Docker endpoints. The malware communicates with a command and control server at IP 178.16.55.224 using a distinctive User-Agent string "libredtail-http. " There is no prior public documentation of RedTail targeting Docker, suggesting either a blind spot in threat intelligence or a recent tactical shift as of November 2025. Exploiting exposed Docker APIs allows attackers to deploy cryptominers directly on container hosts, potentially leading to resource exhaustion and operational disruption. European organizations using Docker with unsecured APIs are at risk, especially those in sectors with high container adoption. Mitigation requires immediate restriction of Docker API exposure, network segmentation, and enhanced monitoring for unusual Docker activity.
Years Long Linux Cryptominer Spotted Using Legit Sites to Spread Malware
Source: https://hackread.com/linux-cryptominer-using-legit-sites-to-spread-malware/
Researchers Find Way to Shut Down Cryptominer Campaigns Using Bad Shares and XMRogue
Source: https://thehackernews.com/2025/06/researchers-find-way-to-shut-down.html
Unit 42 researchers identified a new wave of Prometei botnet attacks in March 2025. The malware, which includes Linux and Windows variants, allows remote control of compromised systems for cryptocurrency mining and credential theft. Prometei is actively developed, incorporating new modules and methods, including a backdoor for various malicious activities. It uses a domain generation algorithm for C2 infrastructure and self-updating features for evasion. The article analyzes versions three and four of the Linux variant, highlighting differences from version two. Prometei's modular architecture makes it highly adaptable, with components for brute-forcing credentials, exploiting vulnerabilities, mining cryptocurrency, stealing data, and C2 communication. The botnet's primary goal is Monero mining, but it also has secondary capabilities like credential theft and deploying additional malware payloads.
