Anti-Coinminer Mining Campaign

Zscaler ThreatLabZ analyzes an 'AntiCoinMiner' cryptomining campaign that uses fake coin-blocker websites to distribute two malware variants which deploy Monero miners (xmrig and xmr-stak). The report details infection chains (batch/PowerShell scripts, SFX archives), persistence via services and PaExec-based privilege escalation, process injection to hide miner execution, and a backdoor in an off-the-shelf miner that siphons mining time to the original author; it includes MD5 hashes, malicious URLs, and wallet addresses as IOCs.