SeleniumGreed: Threat actors exploit exposed Selenium Grid services for Cryptomining

Wiz Research describes an active campaign called “SeleniumGreed” in which attackers abuse publicly exposed Selenium Grid services (often lacking authentication) to run remote Python shells, deploy a modified UPX-packed XMRig miner, and hijack CPU resources; the report includes detailed attack flow, file and network IoCs (hashes, /bin/xm, /bin/wxm, multiple IP:port indicators and TLS fingerprints), MITRE mappings, and recommended mitigations such as enabling authentication, applying network controls, and runtime detection.