Saturday, June 15, 2024

Hackers Spreading Cryptocurrency Mining scripts via videos that Embedded in MS Office Word Documents

Microsoft word documents abused by Cryptocurrency Mining script embedded phishing Videos and victims tricked into watching an “innocent” video that leads to performing a crypto-Jacking Attack on victims PC.

Nowadays Hackers always finding a new malicious way to mining Cryptocurrency by abusing various legitimate platform.

Usually, Browser-based cryptocurrency mining is performed by injecting crypto-jacking script and once the page is open in the browser, Victims CPU will be used to mine a crypto-currency.

Past few years Cryptocurrency mining is a very easy method for cybercriminals to Generating the huge revenue by hijacking the Web- browser and injecting the malicious script and taking control of the CPU Usage from the Victims.

Mining cryptocurrencies in a legitimate way are quite resource consuming process, so attackers demanding ransom payments and infecting other computers to mine the cryptocurrencies.

A new Microsoft Word’s Online Video feature allows the user to insert a remote video into the document.

Attackers Abusing this future and adding some of the innocent videos along with embedded Crypto mining script and tricks used to play the videos that lead to their CPU is being exhausted during this Process.

In this case, Attack choosing interesting videos that make victim will be tempted to watch it.

Cryptocurrency Mining Script with Embedded Videos

In this case, researchers demonstrate the video that is embedded in word document contains a 12 min play time about the Cryptocurrencies.

Once innocent users play the video, Embedded script will be executed and suddenly system CPU Process getting higher and reach 99%.

In this scenario, Attacker using longer Videos to generate a more revenue and also performing another clever trick is to playing long “Loading..” animation that actually contains no videos but its show it as buffering to play the video.

According to votiro, The document can be delivered via spam, and the user can be tricked via social-engineering to disable ‘Protected View’ and click the video.

Crypto-Mining by gaining Complete Control of the System

Another Scenario is that Attacker gaining complete control of the system by executing the malicious code into the targeting system.

Malicious code is executed through MS document Macro tricking the user into executing scripts/files embedded within the document, or vulnerability exploitation.

Many words vulnerabilities are a patch but due to lack of updates from users and they are using an old version of Word Documents, it will be easily approachable by attackers.

Word is a widely used program in most organizations, and as such, maintains ongoing updates and patches as soon as they’re released.


Latest articles

Sleepy Pickle Exploit Let Attackers Exploit ML Models And Attack End-Users

Hackers are targeting, attacking, and exploiting ML models. They want to hack into these...

SolarWinds Serv-U Vulnerability Let Attackers Access sensitive files

SolarWinds released a security advisory for addressing a Directory Traversal vulnerability which allows a...

Smishing Triad Hackers Attacking Online Banking, E-Commerce AND Payment Systems Customers

Hackers often attack online banking platforms, e-commerce portals, and payment systems for illicit purposes.Resecurity...

Threat Actor Claiming Leak Of 5 Million Ecuador’s Citizen Database

A threat actor has claimed responsibility for leaking the personal data of 5 million...

Ascension Hack Caused By an Employee Who Downloaded a Malicious File

Ascension, a leading healthcare provider, has made significant strides in its investigation and recovery...

AWS Announced Malware Detection Tool For S3 Buckets

Amazon Web Services (AWS) has announced the general availability of Amazon GuardDuty Malware Protection...

Hackers Exploiting MS Office Editor Vulnerability to Deploy Keylogger

Researchers have identified a sophisticated cyberattack orchestrated by the notorious Kimsuky threat group.The...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles