Is Cryptojacking Dead After Coinhive Shutdown?

Abstract

Cryptojacking is the exploitation of victims' computer resources to mine for cryptocurrency using malicious scripts. It has become popular after 2017 when attackers started to exploit legal mining scripts, especially Coinhive scripts. Coinhive was actually a legal mining service that provided scripts and servers for in-browser mining activities. Nevertheless, over 10 million web users had been victims every month before the Coinhive shutdown that happened in Mar 2019. This paper explores the new era of the cryptojacking world after Coinhive discontinued its service. We aimed to see whether and how attackers continue cryptojacking, generate new malicious scripts, and developed new methods. We used a capable cryptojacking detector named CMTracker that proposed by Hong et al. in 2018. We automatically and manually examined 2770 websites that had been detected by CMTracker before the Coinhive shutdown. The results revealed that 99% of sites no longer continue cryptojacking. 1% of websites still run 8 unique mining scripts. By tracking these mining scripts, we detected 632 unique cryptojacking websites. Moreover, open-source investigations (OSINT) demonstrated that attackers still use the same methods. Therefore, we listed the typical patterns of cryptojacking. We concluded that cryptojacking is not dead after the Coinhive shutdown. It is still alive, but not as attractive as it used to be. 1

MINOS: A Lightweight Real-Time Cryptojacking Detection System

“…Carlin et al analyzed the growth of cryptojacking in their study [1]. Varlioglu et al [14] inspected the websites that were previously found to have cryptojacking scripts by CMTracker [16].…”

“…Thus, cryptojacking was born, a new cryptocurrency mining malware running covertly on end-user browsers that relies on the latest web technologies and easily reaches its victims via websites without requiring any software installation. The misuse of Coinhive scripts by malicious entities without the consent of end-users facilitated the shut down of Coinhive in March 2019 [14]. Although Coinhive is no longer maintained or operational, numerous studies [15], [14] indicate that cryptojacking malware is still in use in the wild.…”

“…The misuse of Coinhive scripts by malicious entities without the consent of end-users facilitated the shut down of Coinhive in March 2019 [14]. Although Coinhive is no longer maintained or operational, numerous studies [15], [14] indicate that cryptojacking malware is still in use in the wild. The findings of our study add further support to this statement.…”

SoK: Cryptojacking Malware

“…Cryptojacking Dataset Sample Type Focus of the Study [138] 2000 executable binary the practice of using compromised PCs to mine Bitcoin [139] 33282 websites script prevalence analysis [140] --how cybercriminals are exploiting cryptomining [65] 5190 websites script campaign and domain analysis [141] XMR-stak, cpuminer-multi binary attack impact on consumer devices and user annoyance [142] 5700 websites script static, dynamics and economic analysis [143] CoinHive cryptominer script sample characteristics and network traffic analysis [104] 1.2 million miners binary currencies, actors , campaign and earning analysis, underground markets [144] 107511 websites script profitability and the imposed overheads [15] 3.2 TB historical scan results script investigation of a new type of attack that exploits Internet infrastructure for cryptomining [145] --business model, threat sources, implications, mitigations, legality and ethics [146] 53 websites script sample characteristics [147] 2770 websites script activeness analysis [148] XMRig miner binary sample characteristics [135] 156 domains, 25892 proxies script impact on the web users also some new methods [150] proposed by researchers for better and more optimized blacklisting, but even dynamic blacklisting methods are not fully effective nor protective [151] against domain fluxing methods.…”

POSTER: Content-Agnostic Identification of Cryptojacking in Network Traffic

“…Hackers usually conduct cryptojacking by getting the victim to click on a malicious link in an email that downloads crypto-mining code onto their computer, infecting a website with JavaScript code that automatically runs itself once downloaded into a victim's browser, or compromising the servers to stealthily run the mining programs in the background. Although Coinhive, an in-browser mining service provider, shutdown on March 2019, cryptojacking is still alive and evolving [8]. Recently, The Next Web reported that unsuspecting victims were cryptojacked 52.7 million times in the first half of 2019 [5].…”