Hackers are using old tricks and new cryptocurrencies to turn stolen computing power into digital coins.
Have you visited Showtime’s website recently? If so, you may be a cryptocurrency miner. An observant Twitter user was the first to sound an alarm last month that the source code for the Showtime Anytime website contained a tool that was secretly hijacking visitors’ computers to mine Monero, a Bitcoin–like digital currency focused on anonymity.
It’s still not clear how the tool got there, and Showtime quickly removed it after it was pointed out. But if it was the work of hackers, the episode is actually part of a larger trend: security experts have seen a spike in cyberattacks this year that are aimed at stealing computer power for mining operations. Mining is a computationally intensive process that computers comprising a cryptocurrency network complete to verify the transaction record, called the blockchain, and receive digital coins in return.
Lately the same mining tool that appeared on Showtime’s website has been showing up all over the Internet. Released just last month by a company called Coinhive, the tool is supposed to give website owners a way to make money without displaying ads. But malware authors seem to be among its most voracious early adopters. In the past few weeks, researchers have discovered the software hiding in Chrome extensions, hacked Wordpress sites, and even in the arsenal of a notorious “malvertising” hacker group.
Coinhive’s miner isn’t the only one out there, and hackers are using a variety of approaches to hijack computers. Kaspersky Lab recently reported finding cryptocurrency mining tools on 1.65 million of its clients’ computers so far this year—well above last year’s pace.
