Hunting for Threats: Coinhive Cryptocurrency Miner

This article demonstrates how to hunt for Coinhive cryptojacking by combining Censys web-page searches with YARA rules to identify malicious in-page JavaScript; it cites a real-world MikroTik router campaign that impacted ~200,000 devices, shows detection scripts and YARA patterns to reduce false positives, and recommends mitigations such as strong passwords, MFA, patching, plugin review, and logging.