400 Drupal Websites Infected With Malware That Mines Cryptocurrency

The cryptojacking epidemic continues, as hackers steal unsuspecting users' computing power to mine cryptocurrency.

After the revelation of Drupalgeddon 2, security researcher Troy Mursch from Bad Packets Report reported that a number of Drupal websites have became victims of cryptojacking.

The targets were U.S.-based government agencies, including the U.S. National Labor Relations Board (NLRB), educational institutes, including University of California, several tech companies that include Chinese company Lenovo and Taiwanese network hardware maker D-Link.

Government-owned websites in the US, Mexico, Turkey, Peru, South Africa, and Italy have also been affected.

About 400 websites in total were affected, and they were all using outdated versions of Drupal.

Those websites fell as victims as they host JavaScript which uses Coinhive's codes to mine cryptocurrency.

Mursch discovered that all of the infected codes were pointing to the same domain name (vuuwd.com) and same Coinhive key, suggesting that it was a single individual or entity behind all of these attacks.

Mursch’s previous research previous research discovered nearly 50,000 websites to be running cryptojacking campaigns.

Coinhive has received bad reputation due to its codes being used to mine cryptocurrencies by almost 80 percent of unwitting websites.

However, it has also received some legitimacy after it rolled out a feature that required user consent before their computer could be used for mining. This feature of Coinhive was even integrated by UNICEF to fund its charity for children in Bangladesh.

However, researchers have found that the opt-in feature is not popular, and many have chosen to integrate Coinhive without ever informing users.