Cryptocurrency Mining Malware Spread via Messenger, Malvertising, and IoT Botnets

Cryptocurrency-mining malware continued to expand across enterprise and consumer environments through multiple delivery channels, including social media, malicious advertising, and compromised IoT devices. Trend Micro reported that Digmine spread through Facebook Messenger by posing as a video file, then abusing active Chrome-based Facebook sessions to message additional victims and install a modified XMRig Monero miner. Separately, a malvertising campaign abused Google DoubleClick to serve hidden Coinhive and private web miners on legitimate high-traffic sites, driving a sharp rise in detections while consuming as much as 80% of affected systems’ CPU resources.

Researchers also observed an updated Bashlite variant targeting IoT devices, particularly systems exposing the WeMo UPnP API, adding cryptocurrency-mining, backdoor, DDoS, and device-bricking functions to its botnet activity. The broader threat reflects a long-running pattern in which attackers exploit known vulnerabilities, weak configurations, and trusted platforms to hijack computing resources across desktops, servers, Linux hosts, mobile devices, and IoT systems for illicit mining, while also creating opportunities for persistence, further compromise, and operational disruption.