The Internet did my homework
Summary: Cisco Talos observed DNS queries to domains it classifies as "academic fraud" nearly quadruple starting the week of Aug. 12, the most popular US school start week, and found an approximately 4x increase over the same period last year as students moved to virtual learning. Talos also found a copycat site, gceguide[.]xyz, hosting a JavaScript Monero cryptocurrency miner since at least January 2018, and duplicate five-star reviews on the Essaypro Google Play app posted under different names with identical text.
Bottom line: Students researching homework on home networks that are less secured than school or office networks can pull a cryptominer or malicious shellcode onto shared family devices, and the gceguide[.]xyz infrastructure shifted across 8 IP addresses at 4 hosting providers in a single year to stay ahead of blocks.
Read the original at Cisco Talos ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026