monero
Latest
Fake Flash updates upgrade software, but install crypto-mining malware
According to cybersecurity firm Palo Alto Networks, it discovered a fake Flash updater that has been duping conscientious computer users since August. The fake updater installs files to sneak a cryptocurrency mining bot called XMRig, which mines for Monero. But here's the catch, while the fake updater is installing the XMRig malware, it's also updating the user's Flash.
Apple approved a Mac app with a misbehaving crypto-mining feature
You'd think apps with crypto-miners could only be found in various shady venues on the internet. But that's apparently not the case: a popular alternative for the Mac calendar called Calendar 2 recently gave people a way to unlock its Premium features by bundling in a Monero miner with a recent update. And, yes, it was available for download straight from iTunes -- it's just not clear whether it slipped past Apple's watchful eye or if the tech titan really approved it. While you're supposed to agree to switch the miner on in a dialog box (pictured below), at least one person is saying that it launched without his permission:
Salon asks readers to pick their poison: ads or crypto mining
If you use an ad-blocker, you'll now be met with a pop-up when you visit Salon's website, the Financial Times reports. It will offer you two choices -- turn off your ad-blocker or let the website mine cryptocurrency with some of your computer's extra processing power. Salon says on its site that it makes its money off of advertisements, but because more and more readers are now using ad-blockers, it has seen a large drop in revenue. Cryptocurrency mining is its way of recuperating those losses. "Like most media sites, ad-blockers cut deeply into our revenue and create a more one-sided relationship between reader and publisher," Salon says. "For our beta program, we'll start by applying your processing power to mine cryptocurrencies to recoup lost ad revenue when you use an ad blocker. We plan to further use any learnings from this to help support the evolution and growth of blockchain technology, digital currencies and other ways to better service the value exchange between content and user contribution."
Attackers used Telegram to deliver cryptocurrency-mining malware
Kaspersky Lab says it spotted evidence of a vulnerability in the desktop version of Telegram that allowed attackers to install cryptocurrency mining malware on users' computers. The zero-day exploit was used to trick Telegram users into downloading malicious files, which could then be used to deliver cryptocurrency mining software and spyware. According to Kaspersky, those behind the exploit used the computers their malware had been installed on to mine digital currencies like Monero, Zcash, Fantomcoin and others. Kaspersky also says it found a stolen cache of Telegram data on one of the attackers' servers.
Cryptocurrency mining site hijacked millions of Android phones
Smartphone users are just as vulnerable to cryptocurrency mining hijacks as their PC counterparts, and sometimes on a dramatic scale. Malwarebytes has detailed a "drive-by" mining campaign that redirected millions of Android users to a website that hijacked their phone processors for mining Monero. While the exact trigger wasn't clear, researchers believed that infected apps with malicious ads would steer people toward the pages. And it wasn't subtle -- the site would claim that you were showing "suspicious" web activity and tell you that it was mining until you entered a captcha code to make it stop.
Government websites fall prey to cryptocurrency mining hijack
It's not just private companies' websites falling victim to cryptocurrency mining hijacks. Security consultant Scott Helme and the Register have discovered that intruders compromised over 4,200 sites with Coinhive's notorious Monero miner, many of them government websites from around the world. This includes the US court info system, the UK's National Health Service and Australian legislatures, among others. The intruders spread their JavaScript code by modifying an accessibility plugin for the blind, Texthelp's Browsealoud, to inject the miner wherever Browsealoud was in use.
As online ads fail, sites mine cryptocurrency
Between the incessant headlines and chatter on social media, it feels like everywhere we go some libertarian evangelist appears asking us if we have a second to talk about the blockchain -- like a religious wingnut lurking outside the grocery store.
Showtime websites used visitors’ browsers to mine cryptocurrency
Over the weekend, visitors to Showtime's website or its streaming site ShowtimeAnytime might have noticed their computers slowing down a bit. That's because someone slipped in some JavaScript into the sites that caused them to siphon off processing time from users' browsers in order to mine the cryptocurrency Monero. The Register reports that the software took up as much as 60 percent of visitors' CPU capacity.
Pirate Bay 'borrows' visitor CPUs to mine virtual coins
Piracy websites can't really depend on ads, so how do they make money? By using your PC's processor cycles, apparently -- whether you want to or not. Visitors to The Pirate Bay have discovered JavaScript code in the website that 'borrows' your processor for the sake of mining Monero digital coins. It doesn't always happen (it mainly appears in search results and category listings), but you'll definitely notice the sharp spike in CPU usage when it kicks in.
