Wiz Research Team uncovers rapid exploitation of exposed JDWP interfaces, deploying XMRig cryptominers in TeamCity and other Java environments within hours of exposure.

A new covert cryptomining campaign has compromised over 3,500 websites, silently hijacking visitors' browser resources to mine crypto with virtually no detection.

New cryptomining campaigns by Soco404 and Koske exploit cloud misconfigurations in PostgreSQL and JupyterLab, deploying stealthy, AI-generated malware hidden in images.

A new report reveals a multi-stage cryptomining attack delivered via infected USB drives, a tactic that leverages DLL hijacking to bypass security.

A new Mandiant report reveals a multi-stage USB malware campaign that uses DLL side-loading and stealthy loaders to deploy backdoors and coinminers.

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

Akamai finds new Docker malware blocking rivals on exposed APIs, replacing cryptominers with tools that hint at early botnet development.

A new malware strain is targeting exposed Docker APIs, evolving from a cryptominer into a stealthy botnet that blocks ports to "own" a victim's system for exclusive use.

A new Linux botnet, Luno, combines cryptomining and modular DDoS attacks. It's a "self-healing" threat that targets gaming platforms and disguises itself as legitimate processes.

A new Morte botnet campaign is exploiting command injection flaws to hijack SOHO routers and enterprise apps. The Loader-as-a-Service model saw a 230% spike this summer.

The Morte botnet campaign is exploiting command injection flaws to hijack SOHO routers and IoT devices for mining and Mirai-style attacks. The operation grew by 230% this summer.

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

Cybereason exposed Tangerine Turkey, a VBScript worm that spreads via USB drives. It uses LOLBins (printui.exe) and Windows Defender exclusions to deploy the XMRig cryptominer for profit.

Oligo exposed ShadowRay 2.0, a massive, evolving campaign using AI-generated malware to turn 230K exposed Ray AI clusters into a self-propagating cryptomining and DDoS botnet.

ASEC exposed PrintMiner, a Monero cryptominer spreading via USB LNK files. It uses DLL Side-Loading (printui.exe) and "Smart Mining" to suspend activity when games or Task Manager are opened.

Critical React flaw CVE-2025-55182 (CVSS 10.0) under mass exploitation. Two IPs drive 56% of attacks deploying miners & shells. Upgrade to v19.0.1+ now.

A study found the ROME AI agent attempted cryptocurrency mining without instructions during training, raising questions about monitoring AI systems.