Search: “Monero miner”

366 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Malware 187 Ransomware 63 Vulnerability 50 Exploit / PoC 27 Threat actor 21 Industry 6 Data breach 6 Policy & legal 4 Research 1 Advisory 1

SeverityAll critical 99 high 138 medium 116 low 12 info 1

macOS Screen Sharing Flaw Exploited to Deploy Monero Miners

Dutch NCSC confirms active exploitation of critical macOS Screen Sharing flaw CVE-2026-65400, granting root access and installing Monero miners.

CVE-2026-65400 (CVSS 9.8) is an authentication state-management flaw in macOS's built-in Screen Sharing that lets network attackers authenticate without valid credentials. The Dutch NCSC confirmed active exploitation against systems with port 5900 exposed to the internet; in every documented case attackers obtained root access and installed a Monero cryptocurrency miner. Apple patched the bug in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9, crediting Alfredo Pesoli of Bynario. A related researcher scan found roughly 40,000 exposed Screen Sharing hosts, and security firm Calif built working exploits for related flaws in about four hours using an AI coding agent.

Security AffairsAug 15, 08:35 UTC · Aug 15, 2026Exploit / PoC in the wildCVE-2026-65400

Zealot Campaign leverages NSA exploits to deliver Monero miners of both Windows and Linux servers

Security AffairsDec 17, 16:38 UTC · Dec 17, 2017Threat actor CVE-2017-5638 CVE-2017-9822

Many users reported in the past few weeks their Macs have been infected with a new Monero Miner

Security AffairsMay 24, 19:05 UTC · May 24, 2018Malware

Rocke: The Champion of Monero Miners

Cisco TalosAug 30, 15:26 UTC · Aug 30, 2018Vulnerability CVE-2017-10271 CVE-2017-3066

Crooks exploit CVE-2018-7602 Drupal flaw, aka Drupalgeddon3 to deliver Monero miner

Security AffairsJun 22, 17:19 UTC · Jun 22, 2018Vulnerability CVE-2018-7602 CVE-2018-7600 CVE-2014-0160+3 CVEs

ZombieBoy, a new Monero miner that allows to earn $1,000 on a monthly basis

Security AffairsAug 6, 05:09 UTC · Aug 6, 2018Ransomware CVE-2017-9073 CVE-2017-0143 CVE-2017-0146

Langflow RCE Exploited to Deploy Monero Miner on Exposed AI App Endpoints

The Hacker NewsJun 30, 15:47 UTC · Jun 30, 2026Vulnerability in the wildCVE-2026-33017 CVE-2025-32481

Connecting the dots between recently active cryptominers

Cisco TalosDec 18, 16:33 UTC · Dec 18, 2018Malware

Monero Miners Continue to Plague Users via Russian BitTorrent Site

Palo Alto Unit 42Nov 1, 11:03 UTC · Nov 1, 2018Malware

Crackonosh Monero miner made $2M after infecting 222,000 Win systems

Security AffairsJun 27, 12:49 UTC · Jun 27, 2021Malware

Necro Python bot adds new exploits and Tezos mining to its bag of tricks

Cisco TalosJun 3, 12:00 UTC · Jun 3, 2021Vulnerability CVE-2021-3129 CVE-2020-14882 CVE-2017-0144

The Rise of the Cryptocurrency Miners

Palo Alto Unit 42Aug 16, 06:30 UTC · Aug 16, 2018Malware

The Russian pipeline giant Transneft infected with a Monero cryptocurrency miner

Security AffairsDec 17, 08:57 UTC · Dec 17, 2017Malware

RubyMiner Monero Cryptominer affected 30% of networks worldwide in just 24h

Security AffairsJan 17, 20:13 UTC · Jan 17, 2018Malware CVE-2013-0156

First mass BlueKeep exploitation spotted in the wild

Security AffairsNov 3, 14:21 UTC · Nov 3, 2019Exploit / PoC in the wildCVE-2019-0708

Neptune exploit kit used to deliver Monero cryptocurrency miners

Security AffairsAug 23, 08:10 UTC · Aug 23, 2017Vulnerability CVE-2016-0189 CVE-2015-2419 CVE-2014-6332+2 CVEs

Massive Redis Cryptojacking Campaign Hijacks Thousands of Linux Servers

RedisRaider cryptojacking campaign compromises thousands of exposed, unauthenticated Linux Redis servers using cron persistence to deploy XMRig Monero miners.

Hunt.io researchers track a large-scale cryptojacking operation named RedisRaider that scans IPv4 ranges for Redis services exposed on TCP port 6379 and targets instances accepting unauthenticated connections. From a master list of 12,966 candidate hosts, 2,342 were confirmed to accept commands without authentication. Attackers abuse Redis commands (CONFIG SET dir/dbfilename, SET, BGSAVE) to write malicious cron entries into /etc/cron.d or /var/spool/cron, launching XMRig-based Monero miners, with branches including SSH authorized-key injection, Lua probing, and WordPress spraying. The article also references CVE-2026-81934, a Redis TLS use-after-free allowing unauthenticated command execution, fixed in releases including 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1.

GBHackersSep 9, 05:28 UTC · 7d agoExploit / PoC in the wildCVE-2026-81934

China Chopper still active 9 years later

Cisco TalosAug 27, 15:01 UTC · Aug 27, 2019Vulnerability

New Malicious Campaign Delivers Vidar Stealer and Monero Crypto Miner

Infosecurity MagazineJul 8, 11:00 UTC · Jul 8, 2026Malware

Multi-Vector Miner+Tsunami Botnet with SSH Lateral Movement

Security AffairsDec 2, 08:54 UTC · Dec 2, 2020Malware CVE-2020-14882

Cryptocurrency miners were 'distraction technique' in APT's espionage campaigns, Microsoft says

CyberScoopDec 1, 14:34 UTC · Dec 1, 2020Threat actor in the wild

Cloud-Based Cryptocurrency mining attacks abuse GitHub Actions and Azure VM

Security AffairsJul 12, 07:26 UTC · Jul 12, 2022Vulnerability

⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More

Weekly recap: suspected China-nexus APT exploited VMware vCenter CVE-2026-59310, Lazarus used Windows zero-day CVE-2026-68820, and macOS flaw dropped Monero miners.

The week's top stories included a suspected China-nexus APT exploiting VMware vCenter CVE-2026-59310 (CVSS 9.8), a directory-traversal flaw enabling arbitrary code execution, with backdoors, reverse SSH and Babuk-derived ransomware deployed, per QUIRSO. NCSC-NL reported active exploitation of macOS Screen Sharing flaw CVE-2026-65400 (CVSS 9.8) to install Monero miners on systems with port 5900 exposed. Lazarus Group exploited Windows zero-day CVE-2026-68820 (CVSS 7.0) in Operation Dream Job, delivering ForestTiger and Troy backdoors to defense and aerospace targets. GeoServer patched a critical SQL injection flaw exploited within hours of disclosure, and Jamf analyzed the new Amnesia Stealer for macOS with live browser control.

The Hacker NewsAug 17, 17:57 UTC · Aug 17, 2026Exploit / PoC in the wildCVE-2026-59310 CVE-2026-65400 CVE-2026-688201

Apple macOS Screen Sharing Flaw Exploited on Internet

Actively exploited CVE-2026-65400 in macOS Screen Sharing grants pre-auth root access; attackers deploy Monero miners on exposed systems.

NCSC-NL reported active exploitation of CVE-2026-65400 (CVSS 9.8), an authentication flaw in macOS Screen Sharing patched on August 6, 2026, with root access gained and a Monero miner planted on internet-exposed systems using port 5900. Related Screen Sharing bugs CVE-2026-43779, CVE-2026-43777, and CVE-2026-43760 were fixed in macOS Tahoe 26.6, and researcher @osxreverser noted a pre-auth flaw fixed alongside them affecting roughly 40,000 exposed hosts. Calif said an AI agent produced working exploits for both pre-auth bugs in four hours, underscoring the shrinking gap between patch release and weaponization.

The Hacker NewsAug 19, 05:22 UTC · 28d agoExploit / PoC in the wildCVE-2026-65400 CVE-2026-43779 CVE-2026-43777+1 CVEs