Nearly 50K websites infected with cryptocurrency mining malware, research finds

[LASER_oneXM]

Criminals have been injecting websites with scripts to mine the Monero cryptocurrency.

• Nearly 50,000 websites were found to host some type of cryptocurrency mining malware. — Bad Packets report, 2018
• 5,541 WordPress websites were infected with malware as part of cryptojacking campaigns. — Bad Packets report, 2018

In an investigation by Troy Mursch, the author of the Bad Packets Report, nearly 50,000 websites were found to host some type of cryptocurrency mining malware.

Cryptocurrency mining is becoming an increasingly lucrative industry as speculation of digital currencies such as Bitcoin, Ethereum, and Monero have driven up valuation. In the case of Monero, which is more easily capable of being mined on CPUs rather than GPUs, website owners have taken to embedding JavaScript-based mining scripts in order to generate revenue in place of, or in addition to, traditional advertisements.

While some websites provide an opt-out mechanism for mining, many websites do not. As cryptocurrency miners are frequently configured to max out the CPU capacity of a given device—to the extent that devices have been physically damaged—performing cryptocurrency mining via scripts embedded on web pages is inherently parasitical regardless of the intent of the website owner.

As surreptitious coin mining operations, also known as cryptojacking, are becoming increasingly popular among criminals, proactive protections to safeguard against these attacks are necessary. Mursch recommends the minerBlock extension for Chrome and Firefox. Cryptojacking is blocked by default in Opera, and MalwareBytes, a popular anti-malware program, blocked Coinhive shortly after the website launched in September 2017.

Web-based mining attacks are only one component of criminals mining the Monero cryptocurrency in malware attacks. Attacks targeting Android devices, Microsoft Word documents, and Telegram were discovered last month, and criminals have also recycled the EternalBlue vulnerability developed by the NSA to create the mining botnet "Smominru."