If you haven’t been paying attention to the rising scourge of crypto-mining scripts on websites hijacking your computer hardware to mine cryptocurrencies, you should.
From Facebook to YouTube, nobody is apparently safe from this growing menace, with recent reports even suggesting that thousands of government sites in the UK were recently targeted by crypto-mining malware. Now, security researchers at Malwarebytes are reporting that they have found evidence that millions of Android devices may have become part of the largest “drive-by crypto-mining campaign” targeted specifically at mobile devices.
According to the research published on the company’s official blog yesterday, the fact that most people do not use any web-filtering or security applications on their smartphones is being exploited by a section of cyber-criminals to run crypto-mining scripts for Monero (XMR), one of the leading cryptocurrencies right now.
“In a campaign we first observed in late January, but which appears to have started at least around November 2017, millions of mobile users (we believe Android devices are targeted) have been redirected to a specifically designed page performing in-browser cryptomining”.
The exploit uses forced redirects and Trojanized apps, which are not new, but in a curious bit of social engineering, they are honest about being crypto miners. While most cyber-criminals would keep this fact hidden, this new wave of miners is being clear about its purpose. The attackers claim the mining is being done to pay for server traffic, and will continue to do so until the visitor can prove they are human and not ‘bots’, by solving a captcha.
As can be seen in the above screenshots, the sites ask visitors to solve a captcha and till then will use the phone’s resources to mine Monero.
Malwarebytes has listed the affected domains and also the sites with redirect you to these domains. It would be wise to block these from your network if you have the know-how. Ominously, the company warns that the problem is going to get worse with more such mining attacks likely to hit the web. “The first (domain) was registered in late November 2017, and new domains have been created since then, always with the same template”. With cryptocurrencies bouncing back from a slump off-late, it would be interesting to see whether this particular modus operandi will continue in the same vein even after its discovery.
