Symantec finds AI agent hijacking exposed models for autonomous attacks
A honeypot captured a five-layer jailbreak and a loop of up to 100,000 steps that scans, steals data, and installs XMRig.
68
- Mentions · 7d0
- Mentions · 30d1
- All mentions6
- First seenAug 19, 2026
- Last mentioned8d ago
Timeline
6 articles · newest firstHackers Hide XMRig Miner in Windows Registry, PNG and WAV Files to Evade Detection
K7 Security Labs discovered a multi-stage Windows malware chain hiding an XMRig miner in the Registry, PNG, and WAV files.
55
PowerShell Malware Abuses Registry and DNS TXT Records to Deploy XMRig Crypto Miner
K7 Security Labs dissected a PowerShell cryptomining chain hiding payloads in registry, DNS TXT records, PNG pixels and WAV files to deploy XMRig.
55
Hackers Turn More Than 3,500 Redis Servers Into Cryptocurrency Miners
Hunters.io researchers report 3,562 exposed Redis servers hijacked via replication abuse into Monero cryptomining, causing performance loss and data-integrity risk.
50
Massive Redis Cryptojacking Campaign Hijacks Thousands of Linux Servers
RedisRaider cryptojacking campaign compromises thousands of exposed, unauthenticated Linux Redis servers using cron persistence to deploy XMRig Monero miners.
60
Eleethub: A Cryptocurrency Mining Botnet with Rootkit for Self
Unit 42 uncovered Eleethub, a Perl-based Bitcoin mining botnet using a crafted rootkit and libprocesshider to evade detection, still under development with few infections.
35
Related CVEs
by mentions- CVE-2026-81934<1%7.5Use-After-Free in Redis TLS Pending-Data Handling Enables Unauthenticated RCE
Appears with
- XMRigmalware · 4
- Redisvendor · 2
- Redisproduct · 2
- K7 Security Labsvendor · 2
- Eleethubmalware · 1
- Hunt.ioorganization · 1
- Elasticvendor · 1
- go2rtcproduct · 1
- Microsoft Defenderproduct · 1
- WinRing0product · 1
- Symantecorganization · 1
- UnderNetorganization · 1
- Microsoftvendor · 1
- Los Zetasthreat actor · 1
- XMRigvendor · 1
- K7 Security Labsorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.