Open WebUI Misconfiguration Exploited for Cryptojacking (Campaign)

Researchers observed an active exploitation of an internet-exposed, misconfigured Open WebUI instance (admin access with no authentication) where an attacker uploaded an AI-assisted, heavily obfuscated Python payload that deployed Linux cryptominers (T-Rex, XMRig), compiled stealth tools (processhider, argvhider), established persistence via systemd, and used a Discord webhook for C2; a Windows secondary stage delivered a malicious JAR via a JDK installer that dropped Java loaders and DLLs performing credential theft, sandbox evasion, and reconnaissance.