Misconfigured Selenium Grid servers abused for Monero mining

Researchers at Wiz report an active campaign called "SeleniumGreed" that abuses unauthenticated Selenium Grid instances to run base64-encoded Python scripts through the WebDriver API, open reverse shells, and deploy a modified XMRig Monero miner; attackers exploit default configurations and a sudo-enabled 'seluser', use compromised nodes as C2 and mining proxies, and have identified roughly 30,000 exposed instances, creating resource-impacting cryptomining and potential footholds for further malware.