Cryptojacking Malware Detected by Cyber Security Firm on Make-A-Wish Foundation Website

According to a report by cyber security firm Trustwave, the website of global non-profit organization Make-A-Wish has been affected by a cryptojacking malware.

The Trustwave researchers reported that cryptojackers, in order to illicitly mine privacy-focused cryptocurrency Monero (XMR), have managed to incorporate a Java Script (JS) miner coin IMP into the domain worldwish.org. Similarly to the notorious Monero mining software CoinHive, CoinIMP has reportedly been using the computing power of website visitors to mine cryptocurrency.

The CoinIMP script infected the website through the drupalupdates.tk domain, in association with another campaign that exploited a crucial Drupal vulnerability to compromise websites since May 2018.

The researchers noted that like alteration of its already obfuscated domain name, as well as different domains and IPs in a Websocket proxy has been deployed in the recently detected campaign.

In order to report the cryptojacking attack, Trustwave reportedly contacted Make-A-Wish but the foundation did not respond. Another report on this says that the malicious injected script was eventually removed shortly after Trustwave attempted to reach the foundation.

Recently, Internet security provide McAfee Labs uncovered a new Monero-mining malware called Webcobra that allegedly originates from Russia. According to data acquired by Bloomberg, scales of cryptocurrency mining attacks have surged upto 500 percent in 2018.

Earlier in November, Trend Micro, a global cyber security company, detected a new strain of crypto- mining malware targeting PCs running Linux.