{"id":82188,"date":"2017-11-22T06:00:42","date_gmt":"2017-11-22T14:00:42","guid":{"rendered":"https:\/\/securingtomorrow.mcafee.com\/?p=82188"},"modified":"2025-06-02T19:36:18","modified_gmt":"2025-06-03T02:36:18","slug":"malware-mines-steals-cryptocurrencies-from-victims","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mines-steals-cryptocurrencies-from-victims\/","title":{"rendered":"Malware Mines, Steals Cryptocurrencies From Victims"},"content":{"rendered":"<p>How\u2019s your Bitcoin balance? Interested in earning more? The value of cybercurrency is going up. One way to increase your holdings is by <a href=\"https:\/\/www.bitcoinmining.com\/\" target=\"_blank\" rel=\"noopener\">\u201cmining,\u201d<\/a> which is legal as long as it is done with the proper permissions. Using your own mining equipment or establishing a formal agreement for outsourcing are two methods. Hardware vendors such as Asus manufacture motherboards that are specifically tailored for mining cryptocurrency.<\/p>\n<p>Bitcoin mining involves complex mathematical calculations that are carried out by a computer\u2019s hardware and result in transaction records. These records are added to the Bitcoin public ledger, the \u201cblockchain.\u201d The ledger keeps track of all transactions and verifies these transactions are legitimate.<\/p>\n<p>Cybercriminals are also attracted to online currency, which fuels much of their business, including malware purchases and ransomware payments. Cybercriminals would rather find outside computing power instead of using their own equipment because the price of a dedicated mining machine could exceed US$5,000. Cybercriminals often seek to bypass the agreement phase and maliciously introduce malware that will either use a victim\u2019s computing power to mine for coins or simply locate and steal the user\u2019s cryptocurrency.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-82192 size-full\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-1.png\" alt=\"\" width=\"893\" height=\"277\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-1.png 893w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-1-300x93.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-1-768x238.png 768w\" sizes=\"auto, (max-width: 893px) 100vw, 893px\" \/><\/p>\n<p><a href=\"https:\/\/www.bitcoinmining.com\/bitcoin-mining-hardware\/\" target=\"_blank\" rel=\"noopener\"><em>Three popular Bitcoin miners<\/em><\/a><em>.<\/em><\/p>\n<p>&nbsp;<\/p>\n<p>The number of instances of mining malware has increased significantly, to 1.65 million victims this year, <a href=\"https:\/\/securelist.com\/miners-on-the-rise\/81706\/\" target=\"_blank\" rel=\"noopener\">according to one report.<\/a> That\u2019s a lot of slowing machines and increased electricity costs. For individual users, the slowness and increased electricity bill may be trivial, and go unnoticed for a time. For businesses with hundreds or thousands of machines, however, the cost increase can be substantial.<\/p>\n<p>The increased interest in illegally mining or stealing cryptocurrencies correlates easily with the increased value of these currencies. One Bitcoin (BTC) was recently worth more than $7,500, up from around $3,000 a few weeks ago. Even considering an earlier decline in value, Bitcoin has been trending upward for years. This upswing in value and the recent adoption of Bitcoin in Japan and South Korea <a href=\"https:\/\/cointelegraph.com\/news\/japan-officially-recognizes-bitcoin-and-digital-currencies-as-money\" target=\"_blank\" rel=\"noopener\">as a legal tender<\/a> have increased the demand for acquiring Bitcoin and altcoins. In September cybercriminals <a href=\"https:\/\/blog.eset.ie\/2017\/09\/28\/money-making-machine-monero-mining-malware\/\" target=\"_blank\" rel=\"noopener\">stole $63,000<\/a> worth of cryptocurrency in about three months by <a href=\"https:\/\/thehackernews.com\/2017\/09\/windows-monero-miners.html\" target=\"_blank\" rel=\"noopener\">taking advantage<\/a> of a flaw in Microsoft Windows Internet Information Services.<\/p>\n<p><em><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-82193 size-full\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-2.png\" alt=\"\" width=\"1375\" height=\"561\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-2.png 1375w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-2-300x122.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-2-768x313.png 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-2-1024x418.png 1024w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-2-1225x500.png 1225w\" sizes=\"auto, (max-width: 1375px) 100vw, 1375px\" \/>The price of Bitcoin since 2010. <\/em><a href=\"https:\/\/www.coindesk.com\/price\/\" target=\"_blank\" rel=\"noopener\"><em>Source: CoinDesk.<\/em><\/a><\/p>\n<p><a href=\"https:\/\/en.wikipedia.org\/wiki\/Initial_coin_offering\" target=\"_blank\" rel=\"noopener\">Initial coin offerings <\/a>(ICOs) have also contributed to this gold rush. ICOs are similar to IPOs but instead of issuing to investors shares of a new company, the investors are given cryptocurrency in the hopes a new company will be successful and result in a higher value for their digital coins.<\/p>\n<p>During the last few years we have seen an increase in innovation by malware authors to infiltrate this space, resulting in malware that both mines or steals coins and spans various and platforms. Let\u2019s break down some of the tools and techniques in the world of crypto-mining\/-stealing malware that has arisen.<\/p>\n<ul>\n<li>NightMiner<\/li>\n<li>Adylkuzz<\/li>\n<li>EternalMiner<\/li>\n<li>MulDrop.14<\/li>\n<li>ELF Linux\/Mirai<\/li>\n<li>OSX\/Miner-D<\/li>\n<li>Dridex<\/li>\n<li>Trickbot<\/li>\n<li>Jimmy Nukebot<\/li>\n<li>HawkEye<\/li>\n<li>Cerber<\/li>\n<li>Web Mining<\/li>\n<\/ul>\n<h2><strong>NightMiner<\/strong><\/h2>\n<p>NightMiner mining malware was first seen in the wild in March 2015 and has been used to mine the Monero cryptocurrency. Some cybercriminals have turned to Monero due to its built-in security features and lower cost to mine. For example, Monero by default supports many <a href=\"https:\/\/securingtomorrow.mcafee.com\/mcafee-labs\/staying-anonymous-on-the-blockchain-concerns-and-techniques\/\" target=\"_blank\" rel=\"noopener\">blockchain<\/a> obfuscation and anonymity technologies such as stealth addresses and crypto notes. This malicious software has been discovered on network attached storage (NAS) devices and takes advantage of those devices\u2019 powerful CPU and GPU resources. The mining software can stay under the radar on these devices because most administrators fail to install antimalware software on NAS systems. Sophos released <a href=\"https:\/\/www.sophos.com\/en-us\/medialibrary\/PDFs\/technical%20papers\/Cryptomining-malware-on-NAS-servers.pdf\" target=\"_blank\" rel=\"noopener\">an extensive report<\/a> discussing this malware.<\/p>\n<h2><strong>Adylkuzz<\/strong><\/h2>\n<p><a href=\"https:\/\/www.proofpoint.com\/us\/threat-insight\/post\/adylkuzz-cryptocurrency-mining-malware-spreading-for-weeks-via-eternalblue-doublepulsar\" target=\"_blank\" rel=\"noopener\">Adylkuzz<\/a> is more recent, coming on the scene in this year. The mining malware is similar to the well-known ransomware WannaCry in that it exploits two flaws in Microsoft\u2019s server message block (SMB) that are known as EternalBlue and DoublePulsar. Both defects were leaked by the Shadow Brokers hacking group and are believed to be the work of the U.S. National Security Agency&#8217;s Equation Group. Adylkuzz is unique in that it will block all access to TCP Port 445, preventing other malware from taking advantage of the SMB flaws.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-82194 size-full\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-3.png\" alt=\"\" width=\"672\" height=\"164\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-3.png 672w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-3-300x73.png 300w\" sizes=\"auto, (max-width: 672px) 100vw, 672px\" \/><\/p>\n<p><em>Code snippet from the EternalBlue Metasploit module.<\/em><\/p>\n<h2><strong>EternalMiner<\/strong><\/h2>\n<p>Linux systems are not immune. <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/linux-servers-hijacked-to-mine-cryptocurrency-via-sambacry-vulnerability\/\" target=\"_blank\" rel=\"noopener\">EternalMiner<\/a> took advantage of a vulnerability in Samba to infect as many systems as possible. The flaw allowed Samba servers to load and execute code remotely after a shared library was uploaded by a malicious client. A patch to address the seven-year-old flaw was released in May, but cybercriminals made thousands of dollars before network administrators could update their servers.<\/p>\n<h2><strong>Linux.MulDrop.14<\/strong><\/h2>\n<p>Researchers have seen instances of Raspberry Pi\u2014a small, versatile single-board computer\u2014 attacked by the crypto mining malware <a href=\"http:\/\/www.zdnet.com\/article\/linux-malware-enslaves-raspberry-pi-to-mine-cryptocurrency\/\" target=\"_blank\" rel=\"noopener\">Linux.MulDrop.14.<\/a> The malicious software does not attempt to mine the CPU-intensive Bitcoin but, like NightMiner, focuses on Monero. This action shows a level of innovation as cybercriminals expand their scope to acquire cryptocurrencies across additional platforms.<\/p>\n<h2><strong>ELF Linux\/Mirai<\/strong><\/h2>\n<p>Cryptocurrency malware mining has been discovered in connection with the Mirai botnet. ELF Linux\/Mirai continues to evolve and has added a Bitcoin miner slave module, allowing the malware to mine cryptocurrency from thousands of infected IoT devices, <a href=\"https:\/\/securityintelligence.com\/mirai-iot-botnet-mining-for-bitcoins\/\" target=\"_blank\" rel=\"noopener\">according to a report<\/a> from IBM X-Force. <a href=\"https:\/\/en.wikipedia.org\/wiki\/Mirai_(malware)\" target=\"_blank\" rel=\"noopener\">Mirai,<\/a> discovered in August 2016, infected IoT devices and has also been responsible for several DDoS attacks, including against DNS provider Dyn and Liberia\u2019s Internet infrastructure.<\/p>\n<p>&nbsp;<\/p>\n<p><em><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-82195 size-full\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-4.png\" alt=\"\" width=\"1198\" height=\"868\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-4.png 1198w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-4-300x217.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-4-768x556.png 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-4-1024x742.png 1024w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-4-690x500.png 690w\" sizes=\"auto, (max-width: 1198px) 100vw, 1198px\" \/>Source: <\/em><a href=\"https:\/\/www.mcafee.com\/us\/resources\/reports\/rp-quarterly-threats-mar-2017.pdf\" target=\"_blank\" rel=\"noopener\"><em>McAfee Labs Threats Report<\/em><em>, <\/em><em>March <\/em><em>2017<\/em><\/a><\/p>\n<h2><strong>OSX\/Miner-D<\/strong><\/h2>\n<p>Although Apple\u2019s Mac OS has not been heavily targeted, it is also not immune. OSX\/Miner-D both steals Bitcoins and mines a system. This malware has been around since 2011 and is <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/the-second-most-popular-mac-malware-is-a-cryptocurrency-miner\/\" target=\"_blank\" rel=\"noopener\">the second most common malware<\/a> on the Mac. The malware, which is inserted into legitimate apps uploaded to torrent sites, made a surge early this year and resulted in more than 20% of all detections in May. We expect to soon see new variants of this malicious software.<\/p>\n<h2><strong>Dridex<\/strong><\/h2>\n<p>Cryptocurrency mining has caught the attention of the <a href=\"https:\/\/blogs.forcepoint.com\/security-labs\/dridex-shadows-blacklisting-stealth-and-crypto-currency\" target=\"_blank\" rel=\"noopener\">Dridex<\/a> Trojan\u2019s developers. Dridex is a banking Trojan that steals credentials to access accounts. Samples of this malware were discovered in 2016 that find and steal cryptocurrency wallets.<\/p>\n<p>Dridex is sophisticated malware. The developers behind this malware continue to evolve its code to avoid detection, increase infections, distribute ransomware, steal banking and personal information, and now pilfer Bitcoins.<\/p>\n<h2><strong>Trickbot<\/strong><\/h2>\n<p>The cybercriminals behind <a href=\"https:\/\/blogs.forcepoint.com\/security-labs\/trickbot-goes-after-cryptocurrency\" target=\"_blank\" rel=\"noopener\">Trickbot<\/a> have added the capability to steal cryptocurrency. Trickbot has been around for years and has recently added coinbase.com as one of its attack vectors. Once a system is infected, the malware monitors the victim\u2019s browsing habits and injects a fake login page whenever the user visits coinbase.com. The fake page allows criminals to steal the login information, resulting in the theft cryptocurrencies including Bitcoin, Ethereum, and Litecoin as well as other digital assets.<strong>\u00a0<\/strong><\/p>\n<h2><strong>Jimmy Nukebot<\/strong><\/h2>\n<p>Another Trojan making headlines is <a href=\"https:\/\/securelist.com\/jimmy-nukebot-from-neutrino-with-love\/81667\/\" target=\"_blank\" rel=\"noopener\">Jimmy Nukebot.<\/a> The authors behind the malicious software used code from the NeutrinoPOS banker Trojan. This variant, detected by McAfee as RDN\/PWS-Banker, does not steal bank card data as before but installs various modules that contain a payload. One payload mines Monero. The digital wallet associated with the miner has received only about $45, which may indicate the malware authors either changed wallets or have stopped mining, according to Kaspersky.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-82196 size-full\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-5.png\" alt=\"\" width=\"1004\" height=\"558\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-5.png 1004w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-5-300x167.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-5-768x427.png 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-5-900x500.png 900w\" sizes=\"auto, (max-width: 1004px) 100vw, 1004px\" \/><\/p>\n<p><em>McAfee Labs detections for some variants of mining malware. Peek detections are the highest number of detection occurrences on a single date in 2017.<\/em><\/p>\n<h2><strong>HawkEye<\/strong><\/h2>\n<p>The credential harvesting malware <a href=\"https:\/\/www.fireeye.com\/blog\/threat-research\/2017\/07\/hawkeye-malware-distributed-in-phishing-campaign.html\" target=\"_blank\" rel=\"noopener\">HawkEye,<\/a> which surfaced in 2014, has added Bitcoin wallet stealing to its arsenal. The malware is well known for stealing a variety of credentials from web browsers and mail clients. Recent samples show HawkEye targeting the file wallet.dat, which holds the user\u2019s Bitcoin private keys along with other transaction information.<\/p>\n<h2><strong>Cerber<\/strong><\/h2>\n<p>Developers behind most ransomware prefer the ransoms be paid using cryptocurrency. In the recent case of <a href=\"https:\/\/securingtomorrow.mcafee.com\/business\/cerber-ransomware-now-capable-stealing-browser-passwords-bitcoin-wallet-data\/\" target=\"_blank\" rel=\"noopener\">Cerber,<\/a> however, the actors have resorted to stealing the coins from the wallet before encrypting the system. Cerber is one of the most prolific ransomware families, infecting millions of computers worldwide. The ransomware has seen a decline in the past few months but continues to wreak havoc.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-82197 size-full\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-6.png\" alt=\"\" width=\"1236\" height=\"398\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-6.png 1236w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-6-300x97.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-6-768x247.png 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-6-1024x330.png 1024w\" sizes=\"auto, (max-width: 1236px) 100vw, 1236px\" \/><\/p>\n<p><em>The number of Cerber samples detected during the last 90 days. Source: <\/em><a href=\"https:\/\/ransomwaretracker.abuse.ch\/\" target=\"_blank\" rel=\"noopener\"><em>Ransomware Tracker.<\/em><\/a><\/p>\n<h2><strong>Web Mining<\/strong><\/h2>\n<p>One new trend is a technique that mines cryptocurrency when visitors <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/a-new-player-joins-coinhive-on-the-browser-cryptojacking-scene\/\" target=\"_blank\" rel=\"noopener\">connect to websites.<\/a> Coinhive and Crypto-Loot, as well as others, sell Monero mining software that allows the buyer to insert JavaScript into websites. The JavaScript mines cryptocurrency by using the site visitor\u2019s CPU power. The service has been a hot topic since it first appeared because the software can be used maliciously to allow cybercriminals to mine cryptocurrency without users consent. A few legitimate sites, including The Pirate Bay and a major television company, have recently been found using the software to mine Monero. The entertainment conglomerate has removed the code but it remains unclear whether hackers injected the software or if the company included the code to make a few extra dollars while unsuspecting users were watching their favorite shows.<\/p>\n<p>The Pirate Bay has also removed the mining code and released a statement claiming the 24-hour test was designed to see if the popular file-sharing site could use the miner to generate revenue and potentially replace ads. A few other sites, including Iridium and PublicHD, are using the JavaScript code openly: Both sites inform their users of the code and in the case of Iridium allow them to opt out. The unsuspected use of web miners has caused some websites to go dark. Internet provider <a href=\"https:\/\/www.coindesk.com\/cloudflare-suspends-website-using-cryptocurrency-miner-malware\/\" target=\"_blank\" rel=\"noopener\">Cloudflare began shutting down<\/a> domains after the company discovered Coinhive\u2019s software mining Monero from visitors to torrent site ProxyBunker. The domains, which were shuttered for not allowing users to opt out, were reopened after removing the mining code.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-82198 size-full\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-7.png\" alt=\"\" width=\"1492\" height=\"478\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-7.png 1492w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-7-300x96.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-7-768x246.png 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-7-1024x328.png 1024w\" sizes=\"auto, (max-width: 1492px) 100vw, 1492px\" \/><\/p>\n<p><em>JavaScript code from Iridium\u2019s Google Chrome miner extension.<\/em><\/p>\n<p>Crypto mining is not new, but it has gained attention due to the popularity of cryptocurrency, ICOs, and the overall value increase of alt coins. As the adoption rate for cryptocurrency grows, we can expect cybercriminals to increasingly illegally mine or steal cryptocurrency. They can exploit online funds to shop on the dark web or in exchange for real currency.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-82199 size-full\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-8.png\" alt=\"\" width=\"1283\" height=\"405\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-8.png 1283w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-8-300x95.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-8-768x242.png 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-8-1024x323.png 1024w\" sizes=\"auto, (max-width: 1283px) 100vw, 1283px\" \/><\/p>\n<p><em>A timeline of leading cryptocurrency miners. <\/em><\/p>\n<p><a href=\"#_ftnref1\" name=\"_ftn1\"><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>How\u2019s your Bitcoin balance? Interested in earning more? The value of cybercurrency is going up. One way to increase your&#8230;<\/p>\n","protected":false},"author":878,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[1814,76,4452,338,180],"coauthors":[4833,5283],"class_list":["post-82188","post","type-post","status-publish","format-standard","hentry","category-mcafee-labs","tag-computer-security","tag-cybercrime","tag-cybersecurity","tag-endpoint-protection","tag-malware"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Malware Mines, Steals Cryptocurrencies From Victims<\/title>\n<meta name=\"description\" content=\"How\u2019s your Bitcoin balance? Interested in earning more? The value of cybercurrency is going up. You can increase your holdings by mining.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Malware Mines, Steals Cryptocurrencies From Victims\" \/>\n<meta property=\"og:description\" content=\"How\u2019s your Bitcoin balance? Interested in earning more? The value of cybercurrency is going up. You can increase your holdings by mining.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mines-steals-cryptocurrencies-from-victims\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2017-11-22T14:00:42+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-06-03T02:36:18+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-1.png\" \/>\n\t<meta property=\"og:image:width\" content=\"893\" \/>\n\t<meta property=\"og:image:height\" content=\"277\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Tim Hux, Norris Brazier\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@tim_hux\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Tim Hux, Norris Brazier\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mines-steals-cryptocurrencies-from-victims\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mines-steals-cryptocurrencies-from-victims\/\"},\"author\":{\"name\":\"Tim Hux\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/8d881d3760c0cd7284544a1158f8383d\"},\"headline\":\"Malware Mines, Steals Cryptocurrencies From Victims\",\"datePublished\":\"2017-11-22T14:00:42+00:00\",\"dateModified\":\"2025-06-03T02:36:18+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mines-steals-cryptocurrencies-from-victims\/\"},\"wordCount\":1697,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mines-steals-cryptocurrencies-from-victims\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-1.png\",\"keywords\":[\"computer security\",\"cybercrime\",\"cybersecurity\",\"endpoint protection\",\"malware\"],\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mines-steals-cryptocurrencies-from-victims\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mines-steals-cryptocurrencies-from-victims\/\",\"name\":\"Malware Mines, Steals Cryptocurrencies From Victims\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mines-steals-cryptocurrencies-from-victims\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mines-steals-cryptocurrencies-from-victims\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-1.png\",\"datePublished\":\"2017-11-22T14:00:42+00:00\",\"dateModified\":\"2025-06-03T02:36:18+00:00\",\"description\":\"How\u2019s your Bitcoin balance? Interested in earning more? The value of cybercurrency is going up. You can increase your holdings by mining.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mines-steals-cryptocurrencies-from-victims\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mines-steals-cryptocurrencies-from-victims\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mines-steals-cryptocurrencies-from-victims\/#primaryimage\",\"url\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-1.png\",\"contentUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-1.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mines-steals-cryptocurrencies-from-victims\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Malware Mines, Steals Cryptocurrencies From Victims\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/8d881d3760c0cd7284544a1158f8383d\",\"name\":\"Tim Hux\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/62e22279f24354075fe776a3c989cc53\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/04\/Tim-Hux-96x96.jpg\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/04\/Tim-Hux-96x96.jpg\",\"caption\":\"Tim Hux\"},\"description\":\"Tim Hux Security Researcher Advanced Threat Research Tim has over 15 years\u2019 experience in the cyber security field and performs threat research and analysis on today\u2019s top threats.\",\"sameAs\":[\"https:\/\/www.linkedin.com\/in\/timhux\/\",\"https:\/\/x.com\/tim_hux\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/tim-hux\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Malware Mines, Steals Cryptocurrencies From Victims","description":"How\u2019s your Bitcoin balance? Interested in earning more? The value of cybercurrency is going up. You can increase your holdings by mining.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Malware Mines, Steals Cryptocurrencies From Victims","og_description":"How\u2019s your Bitcoin balance? Interested in earning more? The value of cybercurrency is going up. You can increase your holdings by mining.","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mines-steals-cryptocurrencies-from-victims\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2017-11-22T14:00:42+00:00","article_modified_time":"2025-06-03T02:36:18+00:00","og_image":[{"width":893,"height":277,"url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-1.png","type":"image\/png"}],"author":"Tim Hux, Norris Brazier","twitter_card":"summary_large_image","twitter_creator":"@tim_hux","twitter_site":"@McAfee","twitter_misc":{"Written by":"Tim Hux, Norris Brazier","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mines-steals-cryptocurrencies-from-victims\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mines-steals-cryptocurrencies-from-victims\/"},"author":{"name":"Tim Hux","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/8d881d3760c0cd7284544a1158f8383d"},"headline":"Malware Mines, Steals Cryptocurrencies From Victims","datePublished":"2017-11-22T14:00:42+00:00","dateModified":"2025-06-03T02:36:18+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mines-steals-cryptocurrencies-from-victims\/"},"wordCount":1697,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mines-steals-cryptocurrencies-from-victims\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-1.png","keywords":["computer security","cybercrime","cybersecurity","endpoint protection","malware"],"articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mines-steals-cryptocurrencies-from-victims\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mines-steals-cryptocurrencies-from-victims\/","name":"Malware Mines, Steals Cryptocurrencies From Victims","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mines-steals-cryptocurrencies-from-victims\/#primaryimage"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mines-steals-cryptocurrencies-from-victims\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-1.png","datePublished":"2017-11-22T14:00:42+00:00","dateModified":"2025-06-03T02:36:18+00:00","description":"How\u2019s your Bitcoin balance? Interested in earning more? The value of cybercurrency is going up. You can increase your holdings by mining.","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mines-steals-cryptocurrencies-from-victims\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mines-steals-cryptocurrencies-from-victims\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mines-steals-cryptocurrencies-from-victims\/#primaryimage","url":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-1.png","contentUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/11\/20171110-Cryptocurrency-1.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mines-steals-cryptocurrencies-from-victims\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"Malware Mines, Steals Cryptocurrencies From Victims"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/8d881d3760c0cd7284544a1158f8383d","name":"Tim Hux","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/62e22279f24354075fe776a3c989cc53","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/04\/Tim-Hux-96x96.jpg","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/04\/Tim-Hux-96x96.jpg","caption":"Tim Hux"},"description":"Tim Hux Security Researcher Advanced Threat Research Tim has over 15 years\u2019 experience in the cyber security field and performs threat research and analysis on today\u2019s top threats.","sameAs":["https:\/\/www.linkedin.com\/in\/timhux\/","https:\/\/x.com\/tim_hux"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/tim-hux\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/82188","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/878"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=82188"}],"version-history":[{"count":2,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/82188\/revisions"}],"predecessor-version":[{"id":214939,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/82188\/revisions\/214939"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=82188"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=82188"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=82188"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=82188"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}