Hackers Proxyjack & Cryptomine Selenium Grid Servers

Threat actors are actively scanning and compromising Internet-exposed Selenium Grid servers to deploy proxyware (IPRoyal Pawn, EarnFM) and cryptominers (perfcc/XMRig), leveraging scripts, the GSocket toolkit for C2, and an exploit for PwnKit (CVE-2021-4043). Cado Security's honeypot observed rapid automated attacks within 24 hours, and prior scans indicate tens of thousands of Selenium Grid instances are publicly accessible and often outdated, enabling large-scale proxyjacking, cryptomining, and potential escalation into production systems.