New Docker Malware Steals CPU for Crypto & Drives Fake Website Traffic

The report describes a campaign abusing vulnerable Docker services to deploy two containerized payloads: an XMRig monero miner connected to a private pool and a 9Hits Viewer instance used for automated traffic/click-fraud. Attackers appear to scan for exposed Docker APIs (likely via Shodan), pull generic images from Docker Hub, and run containers that exhaust CPU, memory, and bandwidth on compromised hosts; the use of a private mining pool obscures the campaign's scale.