#cryptojacking

[cyber-sec]

Botnet Hunts Servers With Weak Defaults

The GoBruteforcer botnet is sweeping the internet for exposed Linux servers, cracking default credentials to fuel crypto theft and database attacks at massive scale.

Source: Check Point Research

Read more: CyberSecBrief

[thecryptoreport]

Multiple North Korean Cryptocurrency Hacks Under UN Investigation The United Nations has launched an investigation into North Korean cyber-attacks which targeted cryptocurrency exchanges in the neighboring South.

[cyber-sec]

GoBruteforcer Botnet Feasts on Weak Server Passwords

A resurgent GoBruteforcer botnet is breaking into exposed Linux servers by abusing weak and reused credentials, then turning compromised systems towards crypto-focused attacks.

Source: Check Point Research

Read more: CyberSecBrief

[cyber-sec]

Weekly Cybersecurity Briefing (8 – 15 September 2025)

Researchers disclosed multiple large supply-chain intrusions, notably GhostAction exfiltrating 3,325 GitHub secrets and an npm compromise that pushed malicious updates to high-download packages. The Salesloft GitHub breach afforded long-dwell access later leveraged in Salesforce-related intrusions. Several cloud and developer ecosystems reported downstream impacts.

Vendors released broad advisories and emergency fixes during the week, with Microsoft addressing 81 vulnerabilities including two zero-days. Adobe patched the critical SessionReaper flaw in Commerce/Magento, and SAP warned of active exploitation against S/4HANA CVE-2025-42957. Multiple Linux kernel and hypervisor issues also prompted vendor updates.

New malware and espionage activity appeared across platforms, including HybridPetya samples with a UEFI Secure Boot bypass, the modular macOS backdoor ChillyHell, and the fileless EggStreme framework used against a Philippine military contractor. Ransomware groups such as Akira continued to exploit known appliance vulnerabilities.

Phishing and tooling advances were observed, including the Salty2FA kit with multi-stage evasion and the Axios user-agent abuse enabling highly automated credential-theft campaigns. Researchers also reported Docker API abuse for cryptojacking over TOR and evolving remote-access trojans like MostereRAT.

Source: CyberSecBrief

[cyber-sec]

AI Chatbot SEO Poisoning Fuels Large-Scale Cryptojacking Campaign

A cryptojacking operation is abusing AI chatbot responses and SEO poisoning to push fake software downloads that install GPU miners and persistent remote access tools. The malware chain relies on DLL sideloading and abused Microsoft-signed binaries to quietly hijack high-performance systems for mining operations.

Source: Microsoft

Read more: CyberSecBrief

[nordicoclub]

Ameaça Emergente: Manipulação de LLMs para Campanhas de Cryptojacking

Ameaça Emergente: Manipulação de LLMs para Campanhas de Cryptojacking O cenário de ameaças cibernéticas está evoluindo para explorar a confiança crescente nos modelos de linguagem de grande escala (LLM). Recentemente, identificamos uma campanha sofisticada onde chatbots de IA são manipulados para recomendar sites maliciosos sob o pretexto de fornecer utilitários de sistema legítimos. Diferente das campanhas de massa indiscriminadas, esta estratégia utiliza técnicas de envenenamento de resultados de busca em ferramentas de IA para direcionar usuários a domínios controlados por atacantes. O alvo é altamente estratégico: proprietários de hardware de alta performance (GPUs). Ao impersonar softwares conhecidos como CrystalDiskInfo e HWMonitor, os agentes de ameaça buscam maximizar o rendimento da mineração de criptomoedas em máquinas com alto valor computacional. 🛡️ A análise técnica revela uma cadeia de ataque deliberada: 1. O usuário solicita recomendações a um chatbot de IA. 2. A ferramenta sugere links maliciosos via SEO poisoning aplicado à IA. 3. O download de arquivos ZIP contém executáveis legítimos que realizam o sideloading de DLLs maliciosas (autorun.dll). 4. O payload final instala o ScreenConnect, estabelecendo persistência e permitindo acesso remoto para atividades posteriores como roubo de dados ou ransomware. 🚨 Este é um lembrete crítico de que a inteligência artificial não é apenas uma ferramenta de produtividade, mas uma nova superfície de ataque que exige atenção redobrada na verificação de fontes e integridade de downloads. A engenharia social agora possui um novo vetor: a autoridade percebida das respostas geradas por IA. 💻 #ciberseguranca #inteligenciaartificial #cryptojacking Link: https://thehackernews.com/2026/05/ai-chatbot-recommendations-redirect.html

[it4intserversworld]

iT4iNT SERVER AI Chatbot Recommendations Redirect Users to Cryptojacking Malware Sites http://dlvr.it/TSkxVs VDS VPS Cloud

[rwatimes]

LATAM crypto news: Brazil tokenization soars as cryptojacking spreads

➤ Brazil's real-world asset tokenization market has seen explosive growth, with issuance volumes increasing by over 1,130% year-over-year, indicating a shift towards tokenization as a core financial infrastructure component. ➤ Latin America is experiencing a surge in cryptojacking attacks, where hackers exploit websites for illicit crypto mining, leading to device slowdowns and increased electricity costs for users, while legitimate businesses are also compromised. ➤ Bolivia is positioning itself as a regional blockchain hub, with a significant increase in crypto transactions and adoption driven by dollar shortages, despite ongoing cybersecurity challenges and evolving regulatory frameworks.