Saturday, November 2, 2024
HomeCryptocurrency hackHackers Spreading Cryptocurrency Mining scripts via videos that Embedded in MS Office...

Hackers Spreading Cryptocurrency Mining scripts via videos that Embedded in MS Office Word Documents

Published on

Malware protection

Microsoft word documents abused by Cryptocurrency Mining script embedded phishing Videos and victims tricked into watching an “innocent” video that leads to performing a crypto-Jacking Attack on victims PC.

Nowadays Hackers always finding a new malicious way to mining Cryptocurrency by abusing various legitimate platform.

Usually, Browser-based cryptocurrency mining is performed by injecting crypto-jacking script and once the page is open in the browser, Victims CPU will be used to mine a crypto-currency.

- Advertisement - SIEM as a Service

Past few years Cryptocurrency mining is a very easy method for cybercriminals to Generating the huge revenue by hijacking the Web- browser and injecting the malicious script and taking control of the CPU Usage from the Victims.

Mining cryptocurrencies in a legitimate way are quite resource consuming process, so attackers demanding ransom payments and infecting other computers to mine the cryptocurrencies.

A new Microsoft Word’s Online Video feature allows the user to insert a remote video into the document.

Attackers Abusing this future and adding some of the innocent videos along with embedded Crypto mining script and tricks used to play the videos that lead to their CPU is being exhausted during this Process.

In this case, Attack choosing interesting videos that make victim will be tempted to watch it.

Cryptocurrency Mining Script with Embedded Videos

In this case, researchers demonstrate the video that is embedded in word document contains a 12 min play time about the Cryptocurrencies.

Once innocent users play the video, Embedded script will be executed and suddenly system CPU Process getting higher and reach 99%.

In this scenario, Attacker using longer Videos to generate a more revenue and also performing another clever trick is to playing long “Loading..” animation that actually contains no videos but its show it as buffering to play the video.

According to votiro, The document can be delivered via spam, and the user can be tricked via social-engineering to disable ‘Protected View’ and click the video.

Crypto-Mining by gaining Complete Control of the System

Another Scenario is that Attacker gaining complete control of the system by executing the malicious code into the targeting system.

Malicious code is executed through MS document Macro tricking the user into executing scripts/files embedded within the document, or vulnerability exploitation.

Many words vulnerabilities are a patch but due to lack of updates from users and they are using an old version of Word Documents, it will be easily approachable by attackers.

Word is a widely used program in most organizations, and as such, maintains ongoing updates and patches as soon as they’re released.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch...

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan...

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Critical Atlassian Vulnerability Exploited To Connect Servers In Mining Networks

Hackers usually shift their attention towards Atlassian due to flaws in its software, especially...

Log4j Vulnerability Exploited Again To Deploy Crypto-Mining Malware

Recent attacks exploit the Log4j vulnerability (Log4Shell) by sending obfuscated LDAP requests to trigger...

Hackers Abused StackExchange Platform To Deliuver Malicious Python Package

Attackers uploaded malicious Python packages targeting Raydium and Solana users to PyPI, leveraging a...