Unauthorized Coin Mining in the Browser
Summary: Unit 42 tracked coinhive.min.js across 35,119 unique URLs in a single week, with daily counts ranging from 6,000 to over 10,000, and found 94.5% of them on jibberish .bid domains. Coinhive pays site owners 70% of mined Monero value, rival crypto-loot pays 88%, and one site key (t3z562mp2zg1lia7rujy19d67woezmjj) accounted for 35,742 of 36,842 retrieved IDs.
What you should know: Most of the observed sites disabled CPU throttling entirely, so visitors' machines mine at full load without consent - and 155 of the hosting domains sat in the Alexa top 1 million, including 5 in the top 2,000.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026