Crypto Jacking Resurface: Report when Monero Miner Malware hits over 3,500 sites

Hackers have infected over 3,500 websites using stealth encryption scripts that quietly hijack to generate a browser for visitors Moneroprivacy-centric cryptography designed to make transactions more difficult.

Malware does not steal passwords or lock files. Instead, quietly change the visitor’s browser to Monero Mining Engine sucks up small amounts of processing power without user consent.

The campaign, still active at the time of writing, was first revealed by researchers at cybersecurity firm C/Side.

“We have avoided the signs of traditional cryptojacking by adjusting CPU usage and hiding traffic in our WebSocket streams,” C/SIDE revealed Friday.

Cryptographic jacking, which can be spelled as a single word, is usually the misuse of someone’s device to mine a code without the owner’s knowledge.

This tactic attracted mainstream attention in the second half of 2017. This is the rise of Coinhive, the current decommissioning service that temporarily dominated the crypto jacking scene before it was shut down in 2019.

In the same year, reports on its prevalence were contradictory, and to some extent Decryption Even if some threat research labs saw a 29% increase at the time, they have not returned to their “previous levels.”

“Low, slow me down.”

More than a decade later, the tactic appears to be staging a quiet comeback. It’s a reconfiguration from a script that suffocates a noisy CPU to a low profile miner built for stealth and persistence.

Rather than burning devices, today’s campaigns are quietly spreading across thousands of sites, following a new playbook that aims to be “low, my slowness,” as C/Side puts it.

The change in strategy is not a coincidence. Decryption On the condition of anonymity.

This group appears to be reusing old infrastructure to prioritize long-term access and passive income. Decryption I was told.

“These groups are likely already in control of thousands of hacked WordPress sites and e-commerce stores from past MageCart campaigns,” the researchers said. Decryption.

The MageCart campaign is an attack in which hackers inject malicious code into online checkout pages to steal payment information.

“Planting miners is trivial and they just added another script to reuse existing access,” the researchers said.

But what stands out is that it highlights how quietly the campaign is working, making it difficult to detect in the old ways.

“One way past the cryptojack script was using high CPU.” Decryption I was told. “This new wave avoids that by capping CPU usage and communicating WebSockets using a throttle WebAssembly miner that stays under the radar.”

With WebAssembly, your code can run faster within the browser, but WebSockets maintains a constant connection to the server. When combined, these allow crypto miners to work without attracting attention.

The anonymous researcher said the risks “doesn’t target crypto users directly target crypto users. Decryption. “The actual target is the owner of the server and web app,” they added.