With the rise in virtual currency prices, the issue of currency extraction malware has become an epidemic, and now a security researcher named Troy Mursch has claimed that around 50,000 wordpress sites have been infected with foreign currency extraction scripts secretly using user systems.
In this research, using the PublicWWW source code search engine, various code pages were searched and finally 48953 infected websites were detected.
The researcher emphasizes that Coinhive is still the most commonly used secret-language extraction script found in 81% of the sites.
In addition to a large number of infected websites, the speed of the spread of these malware is also significant, for example, Coinhive has targeted 10,000 websites over the past four months.
In 19% of the remaining sites, CoinImp has been found on 4119 sites, DeepMiner on 2160 sites, Crypto-Loot on 2057 sites, and Minr on 692 sites.
Perhaps, in your opinion, the hacker's goal is to get Bitcoin, but the Monroe digital currency (xmr) is the main target of hackers in this section, because many currencies can not extract through the processor.
In February, security researchers found that some government and public websites also secretly run these malware.
The phenomenon has spread to our country long ago, and last month, the skilled team learned of the attacks by knowing the sites that are extracting digital currency due to the hardware and the ability of their visitors' system.
As mentioned before, two main ways are recommended to prevent misuse of such tools. First, use of valid software or plugins that prevent ad-blockers.
The second way is to manually edit the Windows hosts file in the path of windows \ system32 \ drivers \ etc using the Notepad software and adding the coin-hive.com and coinhive addresses.com to browse the blocked sites.