Cryptojacking Resurges Targeting 3,500 Websites With Stealthy Malware

Cryptojacking, the unauthorized use of someone's device to mine cryptocurrency, has resurfaced with a new wave of malware targeting over 3,500 websites. This campaign, which is still active, involves injecting a hidden Monero mining script into websites through a malicious injection chain. The malware operates stealthily, limiting resource use to avoid detection and security scans.

Researchers at a cybersecurity firm discovered the campaign, noting that the malware avoids traditional cryptojacking signs by throttling CPU usage and hiding traffic in WebSocket streams. This tactic allows the malware to stay under the radar, making it difficult to detect with older methods. The campaign appears to be reusing old infrastructure from past Magecart campaigns, which involved injecting malicious code into online checkout pages to steal payment information.

The new wave of cryptojacking is characterized by its low-profile nature, aiming to "stay low, mine slow." Unlike previous campaigns that burned out devices with high CPU usage, today's campaigns spread quietly across thousands of sites. The malware uses throttled WebAssembly miners that cap CPU usage and communicate over WebSockets, enabling it to work without drawing attention.

The primary target of this campaign is not crypto users but server and web app owners. The malware does not steal passwords or lock files; instead, it hijacks visitors' browsers to generate Monero, a privacy-focused cryptocurrency designed to make transactions more difficult to trace. The risk to crypto users is minimal, as the script does not drain wallets, although technically, a wallet drainer could be added to the payload.

This resurgence of cryptojacking highlights the evolving tactics of cybercriminals, who are increasingly focusing on long-term access and passive income. The campaign's ability to operate quietly and persistently poses a significant challenge to website owners and security professionals. As the threat landscape continues to evolve, it is crucial for organizations to remain vigilant and implement robust security measures to protect against such attacks.