Attackers Use Infected Plug-In to Install Cryptomining Tool on Over 4200 Websites

Victims include UKs ICO, and National Health Service and USCourts.gov.

Over 4,200 websites were infected last weekend with a tool that quietly used the computers of people visiting the sites to mine for the Monero cryptocurrency.
Unknown attackers installed the mining software by compromising a third-party browser plug-in called Browsealoud that many websites use to provide speech navigation capabilities for people who need additional support.
Scott Helme, the UK-based researcher who first
reported
on the campaign says it is unclear how the attackers managed to compromise Browsealoud in order to distribute the mining tool. But TextHelp, the company that provides the plug-in has taken it down, so the campaign has been effectively stopped.
The broad takeaway from this is that sites which load content from a supplier like this are at the mercy of that supplier unless they protect themselves, Helme says.
Many of the impacted sites belonged to organizations in the UK and included those of major government organizations such as the Information Commissioners Office, National Health Service, General Medical Council, and Student Loans Company.
Also affected were the websites of the Administrative Office of the United States Courts, the Indiana government, and the Cook County Treasurers office in Illinois.
According to Helme, the attackers altered the Browsealoud Javascript Library so it added a Coinhive Monero cryptocurrency miner to any page that loaded the plug-in. A majority of sites using the plug-in appear to belong to government organizations based on the list of affected websites, Helme says.
The campaign is the latest to highlight the trend by threat actors to hijack computers and use them to mine for various cryptocurrencies. Mining tools like Coinhive are designed to use a computers resources to verify blockchain transactions. Many people voluntarily install such mining software and allow their computers to be used as part of a wider pool of systems for cryptocurrency mining. In return they get paid in digital coins.
Threat actors have latched on to crypto mining as a way to make quick and safe money. Instead of infecting computers to steal data or to extort money from victims, a growing number of attackers have begun hijacking computers and quietly putting them to use in crypto currency mining. In other cases, attackers install the mining tools on websites and hijack the resources of anyone using those sites.
Victims often dont realize their computers are being used for the purpose and most of the mining software itself is legitimate and therefore not always flagged as malicious or unwanted. Researchers at Ciscos Talos security unit recently estimated that an attacker using a botnet of 2,000 hijacked computers can earn upwards of $180,000 a year from cryptocurrency mining.
Organizations can relatively easily protect their websites from being compromised by third-party plug-ins and content by implementing Content Security Policy (CSP) and Subresource Integrity (SRI) says Helme. [These] are two mechanisms that allow a site to control which other sites are allowed to load content into their pages and what content theyre allowed to load, he says.
For instance browsealoud.com could be in the list of allowed sites but coinhive.com wouldnt be, so the Coinhive script wouldnt be loaded, Helme notes.
SRI allows you to check a file by adding an integrity attribute, sometimes called a fingerprint, Helme said. If the file changes, the fingerprint changes and we can detect that.
In the present instance, such an integrity check would have detected the change in the Browsealoud script and prevented it from loading. Admins can also use CSP to require that all scripts on the page have SRI enabled, so no checks are missed. Coupled together, these are the perfect pair, Helme says.
These would have helped the affected sites and would have prevented the infected file from being loaded.
Related content:
Crypto-Mining Attacks Emerge as the New Big Threat to Enterprises
Hack Costs Coincheck Cryptocurrency Exchange $530 Million
Cybercriminals Employ Driveby Cryptocurrency Mining
5 Reasons Why the CISO Is a Cryptocurrency Skeptic

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the
conference
and
to register.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Attackers Use Infected Plug-In to Install Cryptomining Tool on Over 4200 Websites