Categories: Cryptocurrency hack

Hackers Spreading Cryptocurrency Mining scripts via videos that Embedded in MS Office Word Documents

Microsoft word documents abused by Cryptocurrency Mining script embedded phishing Videos and victims tricked into watching an “innocent” video that leads to performing a crypto-Jacking Attack on victims PC.

Nowadays Hackers always finding a new malicious way to mining Cryptocurrency by abusing various legitimate platform.

Usually, Browser-based cryptocurrency mining is performed by injecting crypto-jacking script and once the page is open in the browser, Victims CPU will be used to mine a crypto-currency.

Past few years Cryptocurrency mining is a very easy method for cybercriminals to Generating the huge revenue by hijacking the Web- browser and injecting the malicious script and taking control of the CPU Usage from the Victims.

Mining cryptocurrencies in a legitimate way are quite resource consuming process, so attackers demanding ransom payments and infecting other computers to mine the cryptocurrencies.

A new Microsoft Word’s Online Video feature allows the user to insert a remote video into the document.

Attackers Abusing this future and adding some of the innocent videos along with embedded Crypto mining script and tricks used to play the videos that lead to their CPU is being exhausted during this Process.

In this case, Attack choosing interesting videos that make victim will be tempted to watch it.

Cryptocurrency Mining Script with Embedded Videos

In this case, researchers demonstrate the video that is embedded in word document contains a 12 min play time about the Cryptocurrencies.

Once innocent users play the video, Embedded script will be executed and suddenly system CPU Process getting higher and reach 99%.

In this scenario, Attacker using longer Videos to generate a more revenue and also performing another clever trick is to playing long “Loading..” animation that actually contains no videos but its show it as buffering to play the video.

According to votiro, The document can be delivered via spam, and the user can be tricked via social-engineering to disable ‘Protected View’ and click the video.

Crypto-Mining by gaining Complete Control of the System

Another Scenario is that Attacker gaining complete control of the system by executing the malicious code into the targeting system.

Malicious code is executed through MS document Macro tricking the user into executing scripts/files embedded within the document, or vulnerability exploitation.

Many words vulnerabilities are a patch but due to lack of updates from users and they are using an old version of Word Documents, it will be easily approachable by attackers.

Word is a widely used program in most organizations, and as such, maintains ongoing updates and patches as soon as they’re released.

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

BFDOOR Malware Targets Organizations to Establish Long-Term Persistence

The BPFDoor malware has emerged as a significant threat targeting domestic and international organizations, particularly…

5 hours ago

Uncovering the Security Risks of Data Exposure in AI-Powered Tools like Snowflake’s CORTEX

As artificial intelligence continues to reshape the technological landscape, tools like Snowflake’s CORTEX Search Service…

5 hours ago

UNC3944 Hackers Shift from SIM Swapping to Ransomware and Data Extortion

UNC3944, a financially-motivated threat actor also linked to the group known as Scattered Spider, has…

5 hours ago

Over 2,800 Hacked Websites Targeting MacOS Users with AMOS Stealer Malware

Cybersecurity researcher has uncovered a massive malware campaign targeting MacOS users through approximately 2,800 compromised…

5 hours ago

Hackers Bypass AI Filters from Microsoft, Nvidia, and Meta Using a Simple Emoji

Cybersecurity researchers have uncovered a critical flaw in the content moderation systems of AI models…

6 hours ago

Microsoft Alerts That Default Helm Charts May Expose Kubernetes Apps to Data Leaks

Microsoft’s cybersecurity research team has issued a stark warning about the risks of using default…

6 hours ago