Cryptominers & WebAssembly in Website Malware
Cesar Anjos WebAssembly (also referred to as Wasm) is a binary instruction format that runs in the browser to enable high-performance applications on web pages and can…
Search Results
cryptominer
42 posts
Cryptominers & Backdoors Found in Fake Plugins
Krasimir Konov When cleaning websites, we regularly find phishing pages, malicious code injected into files, and SEO spam. However, over the past couple of months we’ve also…
Obfuscated JavaScript Cryptominer
Samuel Odendaal During an incident response investigation, we detected an interesting piece of heavily obfuscated JavaScript malware. Once decoded, we found out that cryptominers were running on visitor’s…
Cryptominers: Binary-Process-Cron Variants and Methods of Removal
Tyler Lancy This post provides a brief overview of how to manually remove server-side cryptominers and other types of Binary-Process-Cron malware from a server. Unlike browser-based JavaScript…
RawGit CDN is Abused by CryptoLoot Cryptominers
Denis Sinegubko Recently, we came across another way to use files from GitHub repositories in malware infections. This time the infections weren’t via GitHub.io, raw.githubusercontent.com, or github.com/<user>/<repository>/raw/…
CoinImp Cryptominer and Fully Qualified Domain Names
We are all familiar with the conventional domain name notation, where different levels are concatenated with the full stop character (period). E.g. “www.example.com”, where “www”…
GitHub Hosts Infostealers Part 2: Cryptominers and Credit Card Stealers
Update – March 28th, 2018: The fake Flash update files referenced in this post have been moved from GitHub to port.so[.]tl, and the bit.wo[.]tc script…
Server-level Cryptominer Injections
During an investigation on a recent case, we came across a malware infection that came directly from the server. Upon further inspection, we found that…
Malicious Website Cryptominers from GitHub. Part 2.
Recently we wrote about how GitHub/GitHub.io was used in attacks that injected cryptocurrency miners into compromised websites. Around the same time, we noticed another attack…
Malicious Cryptominers from GitHub
Recently, a webmaster contacted us when his AVG antivirus reported that the JS:Miner-C [Trj] infection was found on their site. Our investigation revealed a hidden…
Fake jQuery and Google Analytics Hide Yet Another Cryptominer
This is a quick posts about yet another quite massive attack that installs CoinHive JavaScript Monero miners on compromised websites. You might have already read…