Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Kaspersky Security Blog

Check Point Research

Reddit NetSec

CVE Database V5

Reddit InfoSec News

AlienVault OTX General

SecurityWeek

SANS ISC Handlers Diary

Threatpost

Dark Reading

The Hacker News

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The article discusses the evolution of cryptojacking, from its rise with Coinhive in 2017 to its apparent decline and subsequent resurgence in a more sophisticated form. A new campaign was discovered involving over 3,500 infected websites, using stealthy techniques to mine cryptocurrency without detection. The modern approach involves dropper scripts, environment checks, worker spawning, and C2 communication, prioritizing stealth over resource consumption. This new wave of cryptojacking attacks demonstrates the ongoing cat-and-mouse game between attackers and security measures, highlighting the need for continued vigilance in cybersecurity.

This threat describes a resurgence and evolution of cryptojacking campaigns, which initially gained prominence around 2017 with services like Coinhive. Cryptojacking involves unauthorized use of victims' computing resources to mine cryptocurrency, typically Monero, without their consent. The new campaign identified involves over 3,500 infected websites that have been compromised to stealthily mine cryptocurrency. Unlike earlier cryptojacking efforts that were often noisy and resource-intensive, this modern iteration employs sophisticated techniques to evade detection and minimize resource consumption, thereby prolonging the attack's lifespan and reducing the likelihood of user or administrator discovery.

Key technical aspects include the use of dropper scripts that deploy the mining payload only after performing environment checks to avoid sandboxed or analysis environments. The mining operations leverage web technologies such as WebAssembly for efficient computation, web workers to run mining tasks in parallel without blocking the main browser thread, and WebSocket communication for command and control (C2) interactions. Obfuscation techniques are used to hide malicious code, and the campaign prioritizes stealth by dynamically spawning workers and adjusting mining intensity based on the environment. This approach reflects a cat-and-mouse dynamic between attackers and defenders, with attackers continuously refining their methods to bypass security controls and remain undetected.

Indicators of compromise include specific malicious domains (e.g., yobox.store, trustisimportant.fun, faster.mo) and URLs hosting obfuscated JavaScript mining scripts. The campaign does not rely on exploiting a particular software vulnerability but rather compromises websites to inject mining scripts, making it a widespread threat affecting web users visiting infected sites. Although no known exploits or threat actors are explicitly identified, the scale and sophistication suggest a well-organized campaign.

Overall, this threat highlights the ongoing risk posed by cryptojacking, especially as attackers adopt advanced evasion techniques and leverage modern web technologies to maintain persistence and profitability.

Detailed information about CryptoJacking is dead: long live CryptoJacking. Get real-time updates, technical details, and mitigation strategies.

CryptoJacking is dead: long live CryptoJacking - Live Threat Intelligence - Threat Radar | OffSeq.com

CryptoJacking is dead: long live CryptoJacking

Title	Severity	Type	Source	Date

Threats Tagged 'web workers'

Filter Threats

Threats Tagged 'web workers'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility