TOR-Based Cryptojacking Attack Expands Through Misconfigured Docker APIs

Cybersecurity researchers have identified a TOR-based cryptojacking variant that expands a recent campaign by abusing exposed Docker APIs. The attack chain begins with breaking into misconfigured Docker APIs to launch a new container based on the Alpine Docker image, mounting the host file system, and then running a Base64-encoded payload to download a shell script downloader from a .onion domain.

The script alters SSH configurations to establish persistence, installs tools such as masscan, libpcap, zstd and torsocks for reconnaissance, and forges a path to a command-and-control server while the downloader fetches a second .onion payload. The dropper launches Masscan to locate open Docker API services on port 2375 and repeats the infection by creating new containers with the Base64 command; it also contains checks for port 23 and 9222, though the latter two propagation aspects are not yet fully implemented.

The researchers note the malware could form the foundation of a botnet, and emphasise network segmentation and securing default credentials to reduce risk. The piece also mentions Wiz’s May 2025 report on an AWS SES abuse campaign that used compromised keys for phishing, underscoring the broader threat of credential theft in cloud environments.