Loading story…
Microsoft reported that cryptojacking remains widespread, with Microsoft Defender Antivirus detecting coin miners on hundreds of thousands of devices each month, and said newer variants are increasingly stealthy by operating filelessly and abusing living-off-the-land binaries. The company highlighted Mehcrypt as a representative threat, describing a delivery chain in which the malware arrives in an archive containing AutoIt components, establishes persistence, and then launches mining activity that drives sustained high CPU usage.
The malware was described as using layered obfuscation and defense evasion techniques, including process hollowing into legitimate processes such as VBC.exe and notepad.exe, making detection more difficult through conventional software-only methods. Microsoft said its detection stack combines Intel Threat Detection Technology CPU telemetry with behavioral signals from Defender to identify the miner as Behavior:Win32/CoinMiner.CN!tdt, while Defender for Endpoint generates related alerts to help security teams investigate and contain compromised hosts.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft reported on a newer Mehcrypt variant delivered in an archive with AutoIt components, using persistence mechanisms and process hollowing into VBC.exe and notepad.exe before mining. Microsoft said Defender blocks the activity as Behavior:Win32/CoinMiner.CN!tdt and Defender for Endpoint raises alerts using combined hardware and software telemetry.
Avast published a blog post analyzing the Meh cryptojacker's complex obfuscation techniques. The reference establishes public technical reporting on the malware family.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported two malware campaigns that install cryptocurrency miners through trojanized downloads delivered from pirate streaming sites and fake software portals. In one operation, users visiting illicit movie and TV sites were shown a bogus video-plugin update that delivered a ZIP archive containing a legitimate executable and a malicious DLL; the DLL sideloaded a multi-stage miner framework with persistence, defense evasion, a watchdog, a **RAT** component, and CPU/GPU mining modules. The malware, a modified fork of SilentCryptoMiner, used DNS tunneling for execution gating, installed a service named `GoogleUpdateTaskMachineQC`, weakened Windows defenses, injected into `conhost.exe` and `explorer.exe`, and communicated through rotating domains and infrastructure tied to `107[.]172[.]212[.]235`. Microsoft described a related cryptojacking-focused campaign aimed at owners of high-performance PCs, using fake downloads of popular utilities and hardware-monitoring tools that were promoted through SEO poisoning and, more recently, surfaced in AI assistant recommendations. Those ZIP archives also paired a legitimate executable with a malicious DLL for sideloading, then installed **ScreenConnect** for persistent remote access, set registry autoruns and scheduled tasks, added Microsoft Defender exclusions, checked for analysis tools, and used process hollowing to launch payloads inside trusted Windows processes. After profiling infected systems, the attackers fetched GPU miners including **gminer**, **lolMiner**, and **SRBMiner-MULTI**; researchers warned the access could support not only cryptomining but also data theft, lateral movement, and eventual ransomware deployment.
Jun 29, 2026
Microsoft reported an active cryptojacking campaign that uses poisoned search results and, in some cases, AI chatbot software recommendations to steer users to attacker-controlled sites impersonating popular utilities including CrystalDiskInfo, HWMonitor, Display Driver Uninstaller, FurMark, K-Lite Codec Pack, and PDFgear. The operation appears to target hardware enthusiasts and other users with high-performance GPUs, delivering ZIP archives that bundle legitimate applications with malicious `autorun.dll` files for DLL sideloading. Microsoft said it has identified more than 150 malicious domains tied to the campaign since March 2026. After execution, the malware abuses ScreenConnect for persistent remote access, uses a custom loader with process hollowing into Microsoft-signed .NET binaries, adds Microsoft Defender exclusions, and performs anti-analysis and host reconnaissance before downloading miners such as `gminer`, `lolMiner`, and `SRBMiner-MULTI`. The malware can pause mining during user or GPU activity to reduce detection, and Microsoft warned that the ScreenConnect foothold could also support follow-on actions including data theft, lateral movement, or ransomware. Microsoft said Defender detected and blocked related activity and highlighted mitigations including cloud-delivered protection, EDR in block mode, network and web protection, SmartScreen, and attack surface reduction rules.
Jun 29, 2026
A cryptocurrency-mining malware campaign deployed an **XMRig-based Monero miner** through a dropper that appeared benign unless it was launched with a specific set of command-line arguments. Once triggered, the malware used **process hollowing**, code injection, and a suspended child process to load the miner while keeping the dropped file itself looking non-malicious, frustrating static inspection, sandboxing, and manual analysis. The activity increased in early November, with the highest volume of infection attempts observed on November 20 across Kuwait, Thailand, India, Bangladesh, the United Arab Emirates, Brazil, and Pakistan. The tradecraft aligns with ATT&CK techniques for stealth and evasive communications, including the broader use of **non-standard ports** and protocol mismatches by malware operators to conceal command-and-control or related traffic inside commonly permitted network flows.
Aug 15, 2026