Categories: Security News

Digmine – Cryptocurrency Mining Malware Spreading via Facebook Messenger

Malware miners are in the raise starting from this year, attackers using various social engineering and more sophisticated attacks for spreading Cryptocurrency Miners.

Security researchers spotted a new Cryptocurrency Miner spreading through Facebook messenger spotted first in South Korea and then spread to other regions.

Cryptocurrency-mining bot dubbed Digmine developed in AutoIt and the executable’s distributed as a video file, once the script executed it communicates with C&C server and downloads multiple components.

facebook Messenger cryptocurrencyfacebook Messenger cryptocurrency
Digmine only affects facebook messenger chrome version and if the file opened in any other platforms the malware will not work, if facebook set to log in automatically, it will send the link of the file to your friends.
facebook Messenger cryptocurrencyfacebook Messenger cryptocurrency

It downloads components and saves into directory “%appdata%\<username> directory” it mines Monero and it intends to stay in the system as long as possible.

It will search and launch Chrome then load a malicious browser extension that it retrieves from the C&C server. If Chrome is already running, the malware will terminate and relaunch Chrome to ensure the extension is loaded” says TrendMicro researchers.

Also Read Over 500 Million Users PC’s are Secretly Mining CryptoCurrency in Browser without Users Knowledge

Later its use to download the miner module “codec.exe” and it will connect to C&C for retrieving configuration files, mining component “miner.exe” is an open source Monero miner known as XMRig.

Researchers said “The increasing popularity of cryptocurrency mining is drawing attackers back to the mining botnet business, We disclosed our findings to Facebook, which promptly removed many of the Digmine-related links from its platform”

Indicators of Compromise (IoCs):

Hash detected as TROJ_DIGMINEIN.A (SHA256);
beb7274d78c63aa44515fe6bbfd324f49ec2cc0b8650aeb2d6c8ab61a0ae9f1d
Hash detected as BREX_DIGMINEEX.A (SHA256):
5a5b8551a82c57b683f9bd8ba49aefeab3d7c9d299a2d2cb446816cd15d3b3e9
Hash detected as TROJ_DIGMINE.A (SHA256):
f7e0398ae1f5a2f48055cf712b08972a1b6eb14579333bf038d37ed862c55909

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Zero-Trust Policy Bypass Enables Exploitation of Vulnerabilities and Manipulation of NHI Secrets

A new project has exposed a critical attack vector that exploits protocol vulnerabilities to disrupt…

2 days ago

Threat Actor Sells Burger King Backup System RCE Vulnerability for $4,000

A threat actor known as #LongNight has reportedly put up for sale remote code execution…

2 days ago

Chinese Nexus Hackers Exploit Ivanti Endpoint Manager Mobile Vulnerability

Ivanti disclosed two critical vulnerabilities, identified as CVE-2025-4427 and CVE-2025-4428, affecting Ivanti Endpoint Manager Mobile…

2 days ago

Hackers Target macOS Users with Fake Ledger Apps to Deploy Malware

Hackers are increasingly targeting macOS users with malicious clones of Ledger Live, the popular application…

2 days ago

EU Targets Stark Industries in Cyberattack Sanctions Crackdown

The European Union has escalated its response to Russia’s ongoing campaign of hybrid threats, announcing…

2 days ago

Venice.ai’s Unrestricted Access Sparks Concerns Over AI-Driven Cyber Threats

Venice.ai has rapidly emerged as a disruptive force in the AI landscape, positioning itself as…

2 days ago