Crypto Heist: The Aftermath of a Government Website Cryptojacking Attack
summary
A large cryptojacking campaign is traced to a compromised third‑party text‑to‑speech plugin that silently injects Coinhive to mine Monero to a single wallet, impacting 5,800+ government sites worldwide. Investigation uses network traces, performance scanners, Wayback Machine snapshots, a crawler of the top 1M sites and Google dorking to map scope. Remediation stalls on change control until a Coinhive injected via BrowseAloud third‑party plugin is pinned and an SRI‑pinned script tag provided to NCSC and CSP recommendations are issued.
AI-written summary · about
chapters (13)
- 0:00Discovering the infection
- 2:46Understanding cryptojacking
- 5:48Responsible disclosure process
- 7:20Tracing the injection point
- 10:56Scope of the impact
- 14:20Government coordination
- 17:20Remediation challenges
- 20:40The blank check problem
- 23:40Potential for further harm
- 29:42Subresource Integrity
- 35:15Content Security Policy
- 40:01Magecart and data theft
- 46:38Q&A and concluding thoughts
related talks
46mCrypto Heist: The Aftermath of a Government Website Cryptojacking Attack
59mCrypto Heist: The Aftermath of a Government Website Cryptojacking Attack
25mRaiders of the Javascript-based Malware
36mMining Botnets Reemerge, Bringing Shifts into the Threat Landscape
47mThe Heist: Chasing an Advanced Crypto Attacker Across the Multi-cloud
15mTales from the Underground: Hilarious Cybercrime Fails!!
54mmacOS: Tracking High Profile Targeted Attacks, Threat Actors & TTPs
21mRise of Coinminers