[Malware related to encryption mining makes a comeback, with over 3500 websites implanted with Monero mining scripts]

On July 22, a wave of covert browser-based Mining attacks is spreading across the internet, with over 3,500 websites implanted with secret Monero ( mining scripts. The cybersecurity company c/side first discovered this ongoing attack activity. Unlike traditional crypto hijacking, this malware avoids the obvious characteristics of conventional crypto hijacking by limiting CPU usage and hiding traffic within WebSocket streams. The attackers follow a "keep a low profile, mine slowly" strategy, reusing access gained from past attacks to target unpatched websites and e-commerce servers. According to an anonymous information security researcher, the attackers likely control thousands of compromised WordPress sites and e-commerce stores. This malware uses throttled WebAssembly mining programs to limit CPU usage and communicate via WebSockets, making it difficult to detect by traditional methods.