Cryptojacking Campaign Targets Misconfigured Kubernetes Clusters

Researchers report an ongoing cryptojacking campaign targeting misconfigured, Internet-facing Kubernetes API servers with anonymous authentication enabled; attackers launch malicious Docker images (some with 10,000+ pulls) and deploy benign‑looking DaemonSets to run a UPX-packed DERO miner (named "pause") across cluster nodes, hard‑coding wallet and pool settings and using obfuscation and supporting tools to evade detection and remove competing miners.