Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Caught in the Act: From Intrusive Coin Miners to Scam Websites

Summary: Palo Alto Networks' Unit 42 crawled unknown URLs and Alexa top one million sites from October 19 to November 19, 2018, detecting 9,104 coin mining scripts across 8,712 distinct URLs and 4,788 other malicious JavaScripts across 4,633 URLs that static analysis missed. Of the coin mining URLs, 6,026 (69.1%) began mining without user consent, with Coinhive leading at 46.8% of scripts, and 1,989 URLs led to technical support scams of which at least 1,668 showed the same page and screenshot.

Bottom line: Customers attempted to visit the coin mining URLs more than one million times from over 30,000 devices in a single month, and 33.2% of Coinhive scripts were caught only because behavioral analysis executed the code - hash and syntax-tree matching could not see through the obfuscation.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related