Hackers Hide XMRig Miner in Windows Registry, PNG and WAV Files to Evade Detection
K7 Security Labs discovered a multi-stage Windows malware chain hiding an XMRig miner in the Registry, PNG, and WAV files.
55
Vendor
K7 Security Labs
- Mentions · 7d0
- Mentions · 30d0
- All mentions2
- First seenSep 19, 2026
- Last mentionedSep 21, 2026
Timeline
2 articles · newest firstPowerShell Malware Abuses Registry and DNS TXT Records to Deploy XMRig Crypto Miner
K7 Security Labs dissected a PowerShell cryptomining chain hiding payloads in registry, DNS TXT records, PNG pixels and WAV files to deploy XMRig.
55
Appears with
- XMRigproduct · 2
- XMRigmalware · 2
- WinRing0.sysproduct · 1
- Microsoftvendor · 1
- WinRing0product · 1
- Microsoft Defenderproduct · 1
- K7 Security Labsorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.