Crooks exploit OpenMetadata holes to mine crypto – and leave a sob story for victims

Microsoft reports that threat actors are actively exploiting multiple high- and critical-severity OpenMetadata vulnerabilities (versions prior to 1.3.1) on internet-exposed Kubernetes clusters to bypass authentication and achieve remote code execution. Compromised containers are used to harvest environment credentials, deploy crypto-mining malware from a remote server, and maintain access via Netcat reverse shells and cronjob persistence; organizations should update OpenMetadata, avoid default credentials, and limit internet exposure.