Second post-mortem this month.
1st was a Metabase CVE (on a dev instance). Attempt of data exfiltration and a focussed search for credit cards and payment details.
2nd was Plausible CVE (on a stale / testing instance). Attacker used it for a cryptominer using ~50% of the CPUs.
Stay frosty.
1st was a Metabase CVE (on a dev instance). Attempt of data exfiltration and a focussed search for credit cards and payment details.
2nd was Plausible CVE (on a stale / testing instance). Attacker used it for a cryptominer using ~50% of the CPUs.
Stay frosty.
September 28, 2026 at 7:28 PM
Second post-mortem this month.
1st was a Metabase CVE (on a dev instance). Attempt of data exfiltration and a focussed search for credit cards and payment details.
2nd was Plausible CVE (on a stale / testing instance). Attacker used it for a cryptominer using ~50% of the CPUs.
Stay frosty.
1st was a Metabase CVE (on a dev instance). Attempt of data exfiltration and a focussed search for credit cards and payment details.
2nd was Plausible CVE (on a stale / testing instance). Attacker used it for a cryptominer using ~50% of the CPUs.
Stay frosty.
like check this out. turns your icons to cheese for no reason, it fucking rocks. now everything is cryptominer ransom spyware. it has no soul youtu.be/Ij9ezx4yOF0
Virus.Win32.MouseMX
YouTube video by danooct1
youtu.be
September 28, 2026 at 4:17 PM
like check this out. turns your icons to cheese for no reason, it fucking rocks. now everything is cryptominer ransom spyware. it has no soul youtu.be/Ij9ezx4yOF0
Hackers used a Samsung Flaw to build a Cryptominer inside Victim Systems:
cybersecuritynews.com/samsung-flaw/
cybersecuritynews.com/samsung-flaw/
September 27, 2026 at 8:08 AM
Hackers used a Samsung Flaw to build a Cryptominer inside Victim Systems:
cybersecuritynews.com/samsung-flaw/
cybersecuritynews.com/samsung-flaw/
Hackers Used a Samsung Flaw to Build a Cryptominer Inside Victim Systems
https://commons.now/link/hackers-used-a-samsung-flaw-to-build-a-cryptominer-inside-victim-systems
#Cryptominer #Samsung #Windows
https://commons.now/link/hackers-used-a-samsung-flaw-to-build-a-cryptominer-inside-victim-systems
#Cryptominer #Samsung #Windows
Hackers Used a Samsung Flaw to Build a Cryptominer Inside Victim Systems
Attackers broke into a Windows system through a known flaw in Samsung’s MagicINFO software, then built a cryptocurrency miner on the compromised machine. Rather than arriving as a finished program, t…
commons.now
September 27, 2026 at 6:18 AM
Hackers Used a Samsung Flaw to Build a Cryptominer Inside Victim Systems
https://commons.now/link/hackers-used-a-samsung-flaw-to-build-a-cryptominer-inside-victim-systems
#Cryptominer #Samsung #Windows
https://commons.now/link/hackers-used-a-samsung-flaw-to-build-a-cryptominer-inside-victim-systems
#Cryptominer #Samsung #Windows
Five ways to earn off a box you own. Torrent seeder trades money for reputation, the adware kit is the quiet earner, the miner pays in RipCoin and runs the trace hot. Each one costs disk and each one costs exposure.
https://deviousdevelopments.itch.io/hackfest
https://deviousdevelopments.itch.io/hackfest
September 27, 2026 at 1:12 AM
Five ways to earn off a box you own. Torrent seeder trades money for reputation, the adware kit is the quiet earner, the miner pays in RipCoin and runs the trace hot. Each one costs disk and each one costs exposure.
https://deviousdevelopments.itch.io/hackfest
https://deviousdevelopments.itch.io/hackfest
Samsung MagicINFO Flaw Used to Deploy AnyDesk and Compile Stealthy Cryptominer Payloads https://packetstorm.news/news/view/44128 #news
September 25, 2026 at 8:58 PM
Samsung MagicINFO Flaw Used to Deploy AnyDesk and Compile Stealthy Cryptominer Payloads https://packetstorm.news/news/view/44128 #news
Samsung MagicINFO flaw lets attackers build a cryptominer in-system via defender disablement & admin access. #Samsung #Security #Cryptomining #MagicINFO #Monero #CVE2025-4632 https://thedailytechfeed.com/exploit-in-samsung-magicinfo-enabled-cryptomining-on-windows-systems/
September 25, 2026 at 2:53 PM
Samsung MagicINFO flaw lets attackers build a cryptominer in-system via defender disablement & admin access. #Samsung #Security #Cryptomining #MagicINFO #Monero #CVE2025-4632 https://thedailytechfeed.com/exploit-in-samsung-magicinfo-enabled-cryptomining-on-windows-systems/
The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint
The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint
www.huntress.com
September 25, 2026 at 1:24 PM
The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint
Huntress found an intrusion via Samsung MagicINFO CVE-2025-4632, followed by repeated AnyDesk installs, Defender tampering, and a SilentXMRMiner-based Monero miner compiled on the endpoint and tied to C3Pool. #MagicINFO #AnyDesk #C3Pool
The Not So Silent Miner: Threat Actor Compiles Cryptominer On The Endpoint
Huntress researchers investigated an intrusion that began with exploitation of a Samsung MagicINFO vulnerability, followed by repeated AnyDesk installation attempts, local account creation, and Defender tampering. The attacker then compiled a SilentXMRMiner-based Monero miner directly on the victim endpoint and connected it to C3Pool for mining. #SamsungMagicINFO #AnyDesk #SilentXMRMiner #C3Pool
www.hendryadrian.com
September 24, 2026 at 7:45 PM
Huntress found an intrusion via Samsung MagicINFO CVE-2025-4632, followed by repeated AnyDesk installs, Defender tampering, and a SilentXMRMiner-based Monero miner compiled on the endpoint and tied to C3Pool. #MagicINFO #AnyDesk #C3Pool
The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint
huntaegis.com
September 24, 2026 at 6:30 PM
The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint
@huntress.com
Attackers exploited Samsung MagicINFO, installed AnyDesk, disabled Defender, and compiled a Monero miner.
-
IOCs: 194[.]87[.]89[.]30, auto[.]c3pool[.]org, oldadministrator
-
#CVE-2025-4632 #Cryptominer #ThreatIntel
Attackers exploited Samsung MagicINFO, installed AnyDesk, disabled Defender, and compiled a Monero miner.
-
IOCs: 194[.]87[.]89[.]30, auto[.]c3pool[.]org, oldadministrator
-
#CVE-2025-4632 #Cryptominer #ThreatIntel
Endpoint-Compiled Cryptominer
www.huntress.com
September 24, 2026 at 4:21 PM
@huntress.com
Attackers exploited Samsung MagicINFO, installed AnyDesk, disabled Defender, and compiled a Monero miner.
-
IOCs: 194[.]87[.]89[.]30, auto[.]c3pool[.]org, oldadministrator
-
#CVE-2025-4632 #Cryptominer #ThreatIntel
Attackers exploited Samsung MagicINFO, installed AnyDesk, disabled Defender, and compiled a Monero miner.
-
IOCs: 194[.]87[.]89[.]30, auto[.]c3pool[.]org, oldadministrator
-
#CVE-2025-4632 #Cryptominer #ThreatIntel
Governor Hochul Abandons NY Climate Law and Communities in Back-Room Deal with Climate-Killing Cryptominer - Earthjustice share.google/v4z8bQT8auyn...
Governor Hochul Abandons NY Climate Law and Communities in Back-Room Deal with Climate-Killing Cryptominer
The settlement gives Greenidge Generation a five-year free pass to continue polluting communities near Seneca Lake, in clear violation of the state climate law
share.google
September 22, 2026 at 9:08 PM
Governor Hochul Abandons NY Climate Law and Communities in Back-Room Deal with Climate-Killing Cryptominer - Earthjustice share.google/v4z8bQT8auyn...
Governor Hochul Abandons NY Climate Law and Communities in Back-Room Deal with Climate-Killing Cryptominer - Earthjustice share.google/v4z8bQT8auyn...
Governor Hochul Abandons NY Climate Law and Communities in Back-Room Deal with Climate-Killing Cryptominer
The settlement gives Greenidge Generation a five-year free pass to continue polluting communities near Seneca Lake, in clear violation of the state climate law
share.google
September 22, 2026 at 9:02 PM
Governor Hochul Abandons NY Climate Law and Communities in Back-Room Deal with Climate-Killing Cryptominer - Earthjustice share.google/v4z8bQT8auyn...
Governor Hochul Abandons NY Climate Law and Communities in Back-Room Deal with Climate-Killing Cryptominer - Earthjustice share.google/v4z8bQT8auyn...
Governor Hochul Abandons NY Climate Law and Communities in Back-Room Deal with Climate-Killing Cryptominer
The settlement gives Greenidge Generation a five-year free pass to continue polluting communities near Seneca Lake, in clear violation of the state climate law
share.google
September 22, 2026 at 12:58 AM
Governor Hochul Abandons NY Climate Law and Communities in Back-Room Deal with Climate-Killing Cryptominer - Earthjustice share.google/v4z8bQT8auyn...
Like, cryptominer malware is a thing and is literally based around using a significant chunk of your GPU resources w/o you noticing
September 18, 2026 at 12:26 AM
Like, cryptominer malware is a thing and is literally based around using a significant chunk of your GPU resources w/o you noticing
A Redis cryptomining botnet used a rogue replication attack to hijack 3,562 servers for Monero mining. See how the campaign worked.
#Redis #Cryptomining #XMRig #Monero #Botnet #CyberSecurity #LinuxMalware #ThreatIntel
#Redis #Cryptomining #XMRig #Monero #Botnet #CyberSecurity #LinuxMalware #ThreatIntel
Redis Cryptomining Botnet Hijacks 3,562 Servers for Monero
At a Glance Malware family XMRig cryptominer deployed via Redis abuse Threat actor Unnamed operator (suspected single actor, linked by wallet reuse) Target / victims 3,562 internet-facing Redis servers, mostly APAC cloud hosts Delivery vector Redis rogue replication (SLAVEOF) into cron injection Key capabilities Cron persistence, XMRig mining, C2 heartbeat, multi-path fallback Source
securityonline.info
September 9, 2026 at 1:31 AM
A Redis cryptomining botnet used a rogue replication attack to hijack 3,562 servers for Monero mining. See how the campaign worked.
#Redis #Cryptomining #XMRig #Monero #Botnet #CyberSecurity #LinuxMalware #ThreatIntel
#Redis #Cryptomining #XMRig #Monero #Botnet #CyberSecurity #LinuxMalware #ThreatIntel
it was a cryptominer but they didnt conceal it at all. they just set up a normal ass install of QEMU with an arch linux disk image that ran a monero miner and had it run on startup. showed up in task manager completely normally. actually started laughing when I found it
ive only ever unironically gotten malware from a pirated vst once and it was the dumbest setup of all time
September 8, 2026 at 11:36 AM
it was a cryptominer but they didnt conceal it at all. they just set up a normal ass install of QEMU with an arch linux disk image that ran a monero miner and had it run on startup. showed up in task manager completely normally. actually started laughing when I found it
I can only assume that the classic web interface loads some kind of stealth cryptominer. Why else would the performance be this bad and, judging from the complaints in the forums, this awful for this long.
So using Robinhood Classic screen eats through one of my Xeon processor cores. Like 100%
But if I use the day trading screen Robinhood Legend, Robinhood plays nice with my processors.
I've tried Edge, Firefox, Chrome, Chromium.
Why doesn't the simpler layout behave nicer?
But if I use the day trading screen Robinhood Legend, Robinhood plays nice with my processors.
I've tried Edge, Firefox, Chrome, Chromium.
Why doesn't the simpler layout behave nicer?
August 29, 2026 at 8:46 PM
I can only assume that the classic web interface loads some kind of stealth cryptominer. Why else would the performance be this bad and, judging from the complaints in the forums, this awful for this long.
update: how the fuck does linux mint run windows games so much better than windows 11 itself?? it's like windows 11 is running a cryptominer at all times
August 28, 2026 at 12:42 PM
update: how the fuck does linux mint run windows games so much better than windows 11 itself?? it's like windows 11 is running a cryptominer at all times
Gitea RCE exploit under active use—cryptominer dropped via default settings. Patch now! #Gitea #RCE #Cryptojacking #SecurityNews #DevOps #OpenSource https://thedailytechfeed.com/critical-gitea-rce-under-attack-cryptominer-payloads-deployed/
August 26, 2026 at 7:01 AM
Gitea RCE exploit under active use—cryptominer dropped via default settings. Patch now! #Gitea #RCE #Cryptojacking #SecurityNews #DevOps #OpenSource https://thedailytechfeed.com/critical-gitea-rce-under-attack-cryptominer-payloads-deployed/