Cryptojacking Campaign Targeting K8s Clusters (Campaign)

Researchers identified an active cryptojacking campaign (June 13–23, 2026) leveraging the Realm C2 framework to compromise thousands of Linux hosts in large managed Kubernetes clusters by exploiting vulnerabilities in Argo Workflows and Gogs; attackers deployed cryptominers, stole Kubernetes service account tokens, and used privileged container escapes to spread laterally to over 300 additional nodes. Organizations running Argo Workflows or Gogs are advised to patch immediately and check for indicators of compromise.