Stay updated on Cryptominer threats. Explore news, trends, and insights on cryptocurrency mining malware in information security. Stay safe online.
Search across headline titles and summaries.
Background for this topic.
Cryptomining software uses computing power to validate cryptocurrency transactions and earn digital coins. When deployed maliciously, cryptomining malware hijacks devices without user consent, exploiting CPU or GPU resources to generate cryptocurrency for attackers. This unauthorized use can affect endpoints, servers, cloud instances, and IoT devices, often spreading through compromised software or exposed services.
From a security perspective, cryptomining malware can degrade system performance, increase power consumption, and cause hardware stress or overheating. Detection relies on monitoring unusual resource usage and network traffic linked to mining pools. Mitigation includes patching vulnerabilities, restricting execution of unauthorized binaries, and applying endpoint protection that identifies mining behaviors. Understanding cryptominer activity helps prioritize incident response and resource allocation in affected environments.
Weekly headline count for the current query.
We tracked a cryptocurrency-mining campaign exploiting CVE-2026-33017, which revealed how threat actors are now scanning exposed AI application infrastructure for their next foothold.
The RondoDox botnet has been observed exploiting the critical React2Shell flaw (CVE-2025-55182) to infect vulnerable Next.js servers with malware and cryptominers. [...]
A financially motivated threat actor has been observed exploiting a recently disclosed remote code execution flaw affecting the Craft Content Management System (CMS) to deploy multiple payloads, including a cryptocurrency miner, a loader dubbed Mimo Loader, and residential proxyware
Threat actors are exploiting a critical remote command execution vulnerability, tracked as CVE-2024-50603, in Aviatrix Controller instances to install backdoors and crypto miners. [...]
We uncovered the active exploitation of the Apache ActiveMQ vulnerability CVE-2023-46604 to download and infect Linux systems with the Kinsing malware (also known as h2miner) and cryptocurrency miner.