Is Cryptojacking Dead after Coinhive Shutdown?
share
Cryptojacking is the exploitation of victims' computer resources to mine for cryptocurrency using malicious scripts. It has become popular after 2017. Coinhive, which was a mining service, legally produced scripts and provided servers for in-browser mining activities. Over 10 million web users had been victims every month before Coinhive shutdown that happened on Mar 2019. This paper explores the new era of the cryptojacking world after Coinhive discontinued its service. We aimed to see whether and how attackers continue cryptojacking, generate new malicious scripts, and developed new methods. We used a capable cryptojacking detector named CMTracker that proposed by Hong et al. in 2018. We automatically and manually examined 2770 websites that had been detected by CMTracker before Coinhive. The results revealed that 99 no longer continue cryptojacking. 1 scripts. By tracking these mining scripts, we detected 632 unique cryptojacking websites. Moreover, open source investigations (OSINT) demonstrated that attackers still use the same methods. Therefore, we listed the typical patterns of cryptojacking. We concluded that cryptojacking is not dead after the Coinhive shutdown. It is still alive, but not as attractive as it used to be.
READ FULL TEXT