Hackers Used a Samsung Flaw to Build a Cryptominer Inside Victim Systems

Attackers broke into a Windows system through a known flaw in Samsung’s MagicINFO software, then built a cryptocurrency miner on the compromised machine.

Rather than arriving as a finished program, the miner was assembled there, leaving an unusual activity trail. The case began in early September 2026 with an alert tied to MagicINFO Premium, software used to manage digital signs.

The attackers went on to install a remote access tool, create an administrator account and turn off Microsoft Defender before using the system’s processing power to mine Monero.

Analysts at Huntress identified the activity while investigating a managed endpoint. Huntress said in a report shared with Cyber Security News (CSN) that the intruders used the victim’s own system to compile the miner, a step that produced conspicuous alerts.

The report describes one affected endpoint, not a measured campaign spanning many organizations. The case shows how an exposed flaw can lead to lasting access and stolen computing resources.

The mining itself consumed CPU capacity, while the added remote access and weakened defenses created a broader security concern.

Hackers Used a Samsung Flaw

Investigators linked the entry point to CVE-2025-4632, a MagicINFO vulnerability that lets an attacker write a file with system privileges.

Samsung fixed the flaw in May 2025 after an earlier MagicINFO issue, CVE-2024-7399, received an incomplete fix. Our previous coverage of the MagicINFO file writing vulnerability explains why internet-facing installations needed prompt updates.

The first alert led to advice for the customer on remediation, but eight days later investigators saw fresh activity tied to the same access route.

That sequence matters because the attackers could still use the vulnerable service. The report does not say how many other systems, if any, were affected.

The intruders tried three times to download AnyDesk, a legitimate remote access program they intended to use without authorization.

Their first attempt used a Windows download utility and their second used PowerShell; Microsoft Defender stopped both. A third attempt succeeded, and the attackers set a password so they could reconnect.

Process records traced the activity back through the service running MagicINFO. That link helped investigators connect the remote access installation to the original flaw rather than an unrelated change.

As earlier reporting on criminal abuse of remote tools shows, a familiar administration program can also give an intruder practical control.

The attackers then created a local administrator account using the same password as the remote access tool. They also disabled Microsoft Defender through a Windows settings component. Those steps preserved access and made later activity harder to block.

Building the Miner on the Victim

With those protections lowered, the attackers launched a Monero miner builder from the new user’s Documents folder. It started several Windows development utilities and C compilers as child processes. Generating the miner there might let attackers tailor it to the machine.

That choice had a cost for the intruders. The builder was unsigned, and its burst of compiler activity stood out in endpoint monitoring.

The report describes this as an opportunity for defenders to spot the attack before the finished miner began working, without a signature for the final file.

Investigators later saw the miner connect to a public mining pool, apparently using the host’s CPU and possibly its graphics processor.

Its mining options appeared under Windows Explorer, where they did not belong, suggesting malicious code had been placed inside that process. Another Windows miner investigation likewise illustrates why defenders should examine behavior, not just search for a known executable.

Huntress recommends promptly patching internet-facing MagicINFO installations and treating repeated attempts to download remote access tools as possible signs of intrusion.

Security teams should also watch for unexpected compiler activity and changes to antivirus settings. Finding and removing the miner alone would leave the bigger question unanswered: how did the attacker get in, and is that route still open?

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC