Growing Misuse of Selenium Grid for Cryptomining and Proxyjacking

Cado Security Labs (now part of Darktrace) identified two new campaigns exploiting misconfigured Selenium Grid instances for cryptomining and proxyjacking, highlighting the ongoing abuse of automation infrastructure. Attackers injected scripts to deploy reverse shells and to run IPRoyal Pawn, EarnFM, TraffMonetizer and WatchTower for proxyjacking, while a Golang binary was used to install a cryptominer.

In the first campaign, a Base64 encoded Python script was injected via the goog:chromeOptions configuration and executed, with the script disabling shell history logging to obscure activity. A second campaign used a similar technique with a Base64 encoded Python script that decoded to a Bash script, which retrieved and ran payloads including an ELF binary packed with UPX and a PwnKit exploit to escalate to root, before dropping a miner and a cron-based persistence mechanism.

The post also notes that proxyjacking involves hijacking a victim’s internet connection to act as a proxy, enabling the attacker to monetise the victim’s bandwidth. Published on 9 December 2024, the analysis stresses that misconfigured Selenium Grid instances require authentication and vigilant monitoring to prevent such abuse. according to Wiz (the Wiz blog on seleniumgreed) is referenced as prior context.