Docker hosts hacked in ongoing website traffic theft scheme

A campaign targeting exposed Docker services deploys containers running an XMRig Monero miner and the 9hits traffic-exchange viewer to monetize compromised hosts. Attackers likely scan for vulnerable Docker APIs, pull seemingly benign images from Docker Hub, and run containers that exhaust CPU, memory, and bandwidth while hiding mining activity via a private pool and generating traffic credits through authenticated 9hits sessions.