Malicious Docker Hub Images Drove a 20 Million-Pull Cryptojacking Campaign

Researchers identified a large cryptojacking operation that abused public container registries by uploading 30 malicious images across 10 Docker Hub accounts, which collectively recorded more than 20 million pulls. The images were designed to deploy cryptocurrency miners on victim systems, with most samples mining Monero and frequently using the open-source miner XMRig.

The campaign was tied to multiple Docker Hub accounts, including azurenql, 021982, dockerxmrig, ggcloud1, and ggcloud2, which researchers assessed as part of the same broader operation. Attackers used multiple image tags to support different CPU architectures, operating systems, and miner variants, increasing compatibility and reach, and the observed mining activity was estimated to have generated roughly $200,000 in cryptocurrency while indicating a wider malicious-image problem across public registries.