Fake Flash Updaters Push Cryptocurrency Miners
Summary: Unit 42 found 113 fake Flash updater samples since March 2018 on non-Adobe, cloud-based web servers, with URLs containing the string flashplayer_down.php?clickid=; 77 carry a CoinMiner tag in AutoFocus and the other 36 share tags with them. In an August 24, 2018 test, a sample with SHA256 hash 485352a3985bce69a020dc49e970fde337279eb1986ea699ca6bec1f5a8068ac installed a real Flash Player from Adobe while an XMRig cryptocurrency miner ran in the background, sending traffic over TCP port 14444 to a Monero wallet.
Why it matters: The updater performs a legitimate Adobe Flash installation, so the user sees nothing out of the ordinary while the miner runs - and the campaign's 473 file names and URLs span March 25 to September 10, 2018, meaning this activity was distributed at scale before most defenders noticed.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026