Canadian men extradited for cryptomining spree at US universities
Canadians accused of compromising university networks for cryptocurrency mining between 2016 and 2019.
1
Stories per day · 30 days
3 RSS
Relatedhoneypot4llmjacking4jailbreak3mcp3banking-trojan2cyberdakait2exposed-models2extradition2india2xmrig2ai-agent1ai-agents1android1android-malware1cybercrime1exposed-endpoints1github1go2rtc1
27 stories, newest first · one card per story
Stories tagged #cryptomining
Canadians extradited for 2016-2019 school hacking campaign
Two Canadians are accused of running a cryptomining campaign targeting US schools from 2016 to 2019.
1
Canadians extradited over cryptomining on university supercomputers
Ryan Roach extradited after hijacking US university systems for Electroneum mining from 2016 to 2019
1
Hugging Face crypto-mining models return; a copy stays live
Pluto found 31 repositories posing as Qwen2 checkpoints; the flagship reached 28,412 downloads and a copy remained online.
2
Banking trojans infect 17,960 Android phones in India
Group-IB says seven families intercepted 7,611,443 SMS messages and stole cards, OTPs, and identity data.
1
CyberDakait malware hits 17,960 Indian banking Android devices
Operators intercepted 7,611,443 SMS messages and paired credential theft with XMRig mining on idle phones.
2
Symantec honeypot captures Skynet agent hijacking exposed AI models
The jailbroken agent can run up to 100,000 steps to scan, steal secrets, and mine cryptocurrency on the victim’s bill.
1
Symantec finds AI agent built to hijack models for unattended attacks
The captured kit can run up to 100,000 steps, but researchers have no evidence it was used in real attacks.
Honeypot captures agent that hijacks exposed AI models
The captured prompt tells a stolen model to scan, exploit web apps, steal secrets and mine, for up to 100,000 steps.
Symantec finds AI agent hijacking exposed models for autonomous attacks
A honeypot captured a five-layer jailbreak and a loop of up to 100,000 steps that scans, steals data, and installs XMRig.
5
Symantec honeypot captures AI agent built for autonomous attacks
Instructions covered up to 100,000 actions, including scanning, credential theft and Monero mining, and were not executed.
1
Hackers Exploit Critical AhsayCBS Flaws to Deploy Webshells and XMRig Miners
Hackers chain two AhsayCBS flaws (CVE-2026-105133/105134) to plant webshells and cryptominers across at least five organizations.
Cryptomining botnet hides C2 addresses in GitHub poem, infects over 3,400 servers
PoeLLM cryptomining botnet infected 3,400+ servers running exposed LiteLLM, Ollama, and Gotenberg, decoding C2 addresses from a GitHub poem.
PoeLLM malware has assembled a sweeping botnet, taking technical cues from a poem
PoeLLM malware has compromised over 3,400 servers, encoding its command-and-control address in a GitHub poem.
OllamaDrama: Designing and Deploying a Honeypot to Measure Attacks on Exposed LLM Infrastructure
An Ollama API honeypot logged 290,887 interactions, including RCE, mining, and prompt injection.
Hackers Hide XMRig Miner in Windows Registry, PNG and WAV Files to Evade Detection
K7 Security Labs discovered a multi-stage Windows malware chain hiding an XMRig miner in the Registry, PNG, and WAV files.
3
PowerShell Malware Abuses Registry and DNS TXT Records to Deploy XMRig Crypto Miner
K7 Security Labs dissected a PowerShell cryptomining chain hiding payloads in registry, DNS TXT records, PNG pixels and WAV files to deploy XMRig.
4
Hackers Turn More Than 3,500 Redis Servers Into Cryptocurrency Miners
Hunters.io researchers report 3,562 exposed Redis servers hijacked via replication abuse into Monero cryptomining, causing performance loss and data-integrity risk.
3
The Nansh0u Campaign – Hackers Arsenal Grows Stronger
Guardicore researchers detail the Nansh0u campaign's growing arsenal, with three attacks traced to South African IPs hosted by VolumeDrive.
1
Attackers Exploit Critical Langflow and Rails Flaws in Credential
VulnCheck reports active exploitation of critical Langflow CVE-2026-0768 and Rails CVE-2026-66066 for credential harvesting, with detections rising to 360.
3
When AI infrastructure becomes the target: Securing gateways and control points
Microsoft Threat Intelligence details attacks on exposed AI workloads exploiting LiteLLM gateways for credential harvesting, persistence, and cryptomining.
2
Eleethub: A Cryptocurrency Mining Botnet with Rootkit for Self
Unit 42 uncovered Eleethub, a Perl-based Bitcoin mining botnet using a crafted rootkit and libprocesshider to evade detection, still under development with few infections.
1
New Chaos Variant Targets Misconfigured Cloud Deployments, Adds SOCKS Proxy
Darktrace says the Chaos botnet now targets misconfigured cloud deployments like Hadoop and added a SOCKS proxy for traffic relaying.
CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser
CISA added actively exploited Ray flaw CVE-2025-62593 (CVSS 9.4) to its KEV catalog; the DNS rebinding RCE has powered crypto-mining and DDoS botnet campaigns.
4