Hackers Spreading Cryptocurrency Mining scripts via videos that Embedded in MS Office Word Documents

Microsoft word documents abused by Cryptocurrency Mining script embedded phishing Videos and victims tricked into watching an “innocent” video that leads to performing a crypto-Jacking Attack on victims PC.

Nowadays Hackers always finding a new malicious way to mining Cryptocurrency by abusing various legitimate platform.

Usually, Browser-based cryptocurrency mining is performed by injecting crypto-jacking script and once the page is open in the browser, Victims CPU will be used to mine a crypto-currency.

Past few years Cryptocurrency mining is a very easy method for cybercriminals to Generating the huge revenue by hijacking the Web- browser and injecting the malicious script and taking control of the CPU Usage from the Victims.

Mining cryptocurrencies in a legitimate way are quite resource consuming process, so attackers demanding ransom payments and infecting other computers to mine the cryptocurrencies.

A new Microsoft Word’s Online Video feature allows the user to insert a remote video into the document.

Attackers Abusing this future and adding some of the innocent videos along with embedded Crypto mining script and tricks used to play the videos that lead to their CPU is being exhausted during this Process.

In this case, Attack choosing interesting videos that make victim will be tempted to watch it.

Cryptocurrency Mining Script with Embedded Videos

In this case, researchers demonstrate the video that is embedded in word document contains a 12 min play time about the Cryptocurrencies.

Once innocent users play the video, Embedded script will be executed and suddenly system CPU Process getting higher and reach 99%.

In this scenario, Attacker using longer Videos to generate a more revenue and also performing another clever trick is to playing long “Loading..” animation that actually contains no videos but its show it as buffering to play the video.

According to votiro, The document can be delivered via spam, and the user can be tricked via social-engineering to disable ‘Protected View’ and click the video.

Crypto-Mining by gaining Complete Control of the System

Another Scenario is that Attacker gaining complete control of the system by executing the malicious code into the targeting system.

Malicious code is executed through MS document Macro tricking the user into executing scripts/files embedded within the document, or vulnerability exploitation.

Many words vulnerabilities are a patch but due to lack of updates from users and they are using an old version of Word Documents, it will be easily approachable by attackers.

Word is a widely used program in most organizations, and as such, maintains ongoing updates and patches as soon as they’re released.