Google’s DoubleClick Abused to Deliver Miners

Trend Micro observed a malvertising campaign in January 2018 that hijacked Google DoubleClick ads on high-traffic websites to deliver Coinhive and a modified private web miner, causing a ~285% increase in detections on January 24; the attackers used randomized logic to run either Coinhive or a private miner (to avoid Coinhive fees), configured heavy CPU usage via throttle settings, and the report provides IoCs (file hashes and multiple malicious domains) and recommended countermeasures.