From poisoned search results to GPU mining: A cryptojacking campaign abusing ScreenConnect and Microsoft .NET utilities

Microsoft Defender describes an active, targeted cryptojacking campaign that lures GPU-capable users to attacker-controlled lookalike sites via SEO poisoning and AI chatbot responses, delivers spoofed utilities containing a malicious autorun.dll that sideloads and installs ScreenConnect, and uses process hollowing and runtime downloader logic to execute GPU miners (gminer, lolMiner, SRBMiner-MULTI). The campaign includes robust persistence, defender-exclusion techniques, host reconnaissance, certificate-pinned WebSocket C2s, and over 150 malicious domains and multiple IOCs; Microsoft provides detection queries and mitigation recommendations such as enabling cloud protection, EDR block mode, ASR rules, and SmartScreen.