Loading malware…
Coinhive was a JavaScript-based cryptocurrency mining service that used website visitors’ CPU resources to mine Monero through their browsers. Although website operators could deploy it for revenue generation, attackers widely abused it for unauthorized mining by embedding its scripts in compromised webpages, advertisements, and browser extensions. Mining consumed endpoint processing resources and could degrade performance and increase electricity consumption.
Coinhive was distributed through malvertising on legitimate high-traffic websites, including a January 2018 campaign that abused Google DoubleClick advertisements. That campaign configured miners to consume approximately 80 percent of available CPU resources while displaying legitimate advertising content. FacexWorm injected obfuscated Coinhive scripts into visited webpages, while Linux Rabbit and Rabbot inserted Coinhive scripts into web content on compromised servers to mine through visitors’ browsers. IcedID also deployed mining JavaScript using Coinhive’s AuthedMine code.
Attackers additionally exploited MikroTik RouterOS vulnerability CVE-2018-14847 in campaigns that distributed Coinhive code beginning in July 2018. Compromised routers redirected HTTP traffic through a proxy and served mining code within modified error pages, causing mining to execute in downstream users’ browsers rather than on the routers themselves. Coinhive’s browser-based execution enabled opportunistic abuse across diverse websites and user populations. The service ceased operations on March 8, 2019.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
8 distinct techniques documented for this family, organized by ATT&CK tactic.
the number of Coinhive web miner detections tripled due to a malvertising campaign... Attackers abused Google’s DoubleClick... for traffic distribution.
"Drive-By Cryptojacking In-Browser... scripts have been observed on compromised websites, third-party advertising platforms"
The advertisement has a JavaScript code that generates a random number between variables 1 and 100... For the other 10%, a private web miner will be launched.
XiaoBa также внедряет (инжектирует) скрипт Coinhive во все файлы HTML и HTM
After de-obfuscating the private web miner called mqoj_1.js , there will be a JavaScript code that is still based on Coinhive.
XiaoBa также внедряет (инжектирует) скрипт Coinhive во все файлы HTML и HTM
After enabling the Mikrotik RouterOS HTTP proxy, the attacker uses a trick in the configuration by redirecting all the HTTP proxy requests to a local HTTP 403 error page, and in this error page a link for web mining code from coinhive.com is inserted.
After enabling the Mikrotik RouterOS HTTP proxy, the attacker uses a trick in the configuration by redirecting all the HTTP proxy requests to a local HTTP 403 error page, and in this error page a link for web mining code from coinhive.com is inserted.
The modified web miner will use a different mining pool at wss[:]//ws[.]l33tsite[.]info[:]8443. This is done to avoid Coinhive’s 30% commission fee.
The attacker hopes to perform web mining for all the proxy traffic on the users’ devices.
12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.