Digmine Miner Spreading via Facebook Messenger

This report analyzes Digmine, a cryptocurrency-mining bot that spreads through Facebook Messenger by delivering an AutoIt executable disguised as a video and loading a malicious Chrome extension to propagate. The malware installs persistence, downloads an XMRig-based Monero miner, retrieves configurations from C2 servers, and uses specific HTTP headers for C2 communication; the report includes hashes and C2 domains as IoCs and recommends security best practices for social media accounts.