Thursday, February 13, 2025
HomeCryptocurrency hackHackers Spreading Cryptocurrency Mining scripts via videos that Embedded in MS Office...

Hackers Spreading Cryptocurrency Mining scripts via videos that Embedded in MS Office Word Documents

Published on

SIEM as a Service

Follow Us on Google News

Microsoft word documents abused by Cryptocurrency Mining script embedded phishing Videos and victims tricked into watching an “innocent” video that leads to performing a crypto-Jacking Attack on victims PC.

Nowadays Hackers always finding a new malicious way to mining Cryptocurrency by abusing various legitimate platform.

Usually, Browser-based cryptocurrency mining is performed by injecting crypto-jacking script and once the page is open in the browser, Victims CPU will be used to mine a crypto-currency.

Past few years Cryptocurrency mining is a very easy method for cybercriminals to Generating the huge revenue by hijacking the Web- browser and injecting the malicious script and taking control of the CPU Usage from the Victims.

Mining cryptocurrencies in a legitimate way are quite resource consuming process, so attackers demanding ransom payments and infecting other computers to mine the cryptocurrencies.

A new Microsoft Word’s Online Video feature allows the user to insert a remote video into the document.

Attackers Abusing this future and adding some of the innocent videos along with embedded Crypto mining script and tricks used to play the videos that lead to their CPU is being exhausted during this Process.

In this case, Attack choosing interesting videos that make victim will be tempted to watch it.

Cryptocurrency Mining Script with Embedded Videos

In this case, researchers demonstrate the video that is embedded in word document contains a 12 min play time about the Cryptocurrencies.

Once innocent users play the video, Embedded script will be executed and suddenly system CPU Process getting higher and reach 99%.

In this scenario, Attacker using longer Videos to generate a more revenue and also performing another clever trick is to playing long “Loading..” animation that actually contains no videos but its show it as buffering to play the video.

According to votiro, The document can be delivered via spam, and the user can be tricked via social-engineering to disable ‘Protected View’ and click the video.

Crypto-Mining by gaining Complete Control of the System

Another Scenario is that Attacker gaining complete control of the system by executing the malicious code into the targeting system.

Malicious code is executed through MS document Macro tricking the user into executing scripts/files embedded within the document, or vulnerability exploitation.

Many words vulnerabilities are a patch but due to lack of updates from users and they are using an old version of Word Documents, it will be easily approachable by attackers.

Word is a widely used program in most organizations, and as such, maintains ongoing updates and patches as soon as they’re released.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Palo Alto PAN-OS Zero-Day Flaw Allows Attackers to Bypass Web Interface Authentication

Palo Alto Networks has disclosed a zero-day vulnerability in its PAN-OS software (CVE-2025-0108), allowing...

Enhancing Threat Detection With Improved Metadata & MITRE ATT&CK tags

The cybersecurity landscape continues to evolve rapidly, demanding more sophisticated tools and methodologies to...

Hackers Exploit Ivanti Connect Secure Vulnerability to Inject SPAWNCHIMERA malware

In a concerning development, cybersecurity experts have identified active exploitation of a critical vulnerability...

ZeroLogon Ransomware Exploits Windows AD to Hijack Domain Controller Access

A newly intensified wave of ransomware attacks has surfaced, leveraging the infamous ZeroLogon vulnerability...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

Malicious Solana Packages Attacking Devs Abusing Slack And ImgBB For Data Theft

Malicious packages "solanacore," "solana login," and "walletcore-gen" on npmjs target Solana developers with Windows...

PHP Servers Vulnerability Exploited To Inject PacketCrypt Cryptocurrency Miner

Researchers observed a URL attempts to exploit a server-side vulnerability by executing multiple commands...

The Defender vs. The Attacker Game

The researcher proposes a game-theoretic approach to analyze the interaction between the model defender...