xmrig

Threat actors are exploiting Steam discussion forums in a social engineering campaign known as ClickFix, where they pose as helpful users offering technical fixes. They trick victims into running malicious PowerShell commands that download and execute an XMRig cryptominer. The script masquerades as a Windows optimization tool, performs fake maintenance tasks, and establishes persistence via scheduled tasks and Defender exclusions, ultimately leading to cryptocurrency mining on compromised systems.

RedisRaider is a Linux cryptojacking campaign that targets publicly exposed Redis servers to deploy a custom XMRig miner. The threat actor uses aggressive scanning, obfuscation techniques, and cron job manipulation to propagate and maintain persistence. The campaign also leverages in-browser mining infrastructure, indicating a multi-pronged monetization strategy. Anti-forensics measures such as short-lived Redis keys and configuration tampering are used to evade detection.

A new opportunistic campaign exploiting the Log4Shell vulnerability (CVE-2021-44228) has been observed targeting vulnerable Java applications. The attack uses obfuscated LDAP requests to deliver a malicious Java class, which downloads and executes a crypto-mining payload (XMRig) and establishes persistence via systemd or cron. The threat actor exfiltrates system information and maintains remote access through encrypted reverse shells using Perl and netcat.

The Mimo threat actor, previously known for targeting Craft CMS, has expanded its operations to compromise Magento CMS platforms and misconfigured Docker instances through PHP-FPM vulnerabilities. The actor employs sophisticated persistence and evasion techniques, including GSocket-based reverse shells, in-memory execution via memfd_create(), and process masquerading to mimic kernel threads. Mimo monetizes compromised systems through cryptojacking using XMRig and proxyjacking via IPRoyal Pawns, indicating a dual revenue strategy. This evolution reflects increased operational sophistication and a broader targeting scope beyond CMS platforms.

A malicious Go module, github.com/kaleidora/dnsub-scanning-tool, serves as a lure to deliver a multi-stage Windows malware chain involving hidden PowerShell execution and encrypted payload resolution via public dead drops. The campaign, tracked as Operation Muck and Load, leverages a network of 222 GitHub repositories across 190 accounts to create credibility and scale for malicious or deceptive software projects. These repositories use synthetic activity to appear recently maintained, facilitating social engineering and malware distribution. The final payload includes RATs such as AsyncRAT, Quasar, and Remcos, along with infostealers like Vidar, enabling credential theft, screen capture, and persistence.

Multiple cyber threat campaigns were observed in mid-2026, including malicious NuGet packages distributing spyware disguised as game cheats, fake installers delivering the Starland RAT and WLDR C2 implant, and a new ransomware family named Spirals that encrypted a South Asian IT firm's network within 24 hours. Threat actors exploited known vulnerabilities such as CVE-2026-46817 and CVE-2023-4346, while also leveraging social engineering via phishing eCards and OAuth device code attacks. Additional threats include large-scale infostealer distribution through fake GitHub repositories, Chrome Sync abuse for stalking, and dual monetization campaigns deploying Vidar stealer and XMRig miner.

In April 2026, a financially motivated campaign distributed the Vidar stealer and XMRig cryptocurrency miner via malvertising, targeting users searching for cracked software. The attackers used password-protected archives with fake code signing certificates to evade detection and deliver payloads. The malware employed file inflation, DLL sideloading, and AMSI bypass techniques to avoid sandbox analysis and security controls. Victims were primarily located in the U.S. and EU, with data exfiltrated to C2 servers and Monero mining initiated through a configured pool.