The Pulse of Fileless Cryptojacking Attacks: Malicious PowerShell Scripts

• URL: http://arxiv.org/abs/2401.07995v2
• Date: Wed, 21 Feb 2024 10:29:37 GMT
• Title: The Pulse of Fileless Cryptojacking Attacks: Malicious PowerShell Scripts
• Abstract summary: Fileless malware predominantly relies on scripts, leveraging the native capabilities of Windows systems to execute stealthy attacks that leave no traces on the victim's system. This paper provides a comprehensive analysis of cryptocurrency scripts of fileless cryptojacking, dissecting the common malicious patterns based on the MITRE ATT&CK framework.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Fileless malware predominantly relies on PowerShell scripts, leveraging the native capabilities of Windows systems to execute stealthy attacks that leave no traces on the victim's system. The effectiveness of the fileless method lies in its ability to remain operational on victim endpoints through memory execution, even if the attacks are detected, and the original malicious scripts are removed. Threat actors have increasingly utilized this technique, particularly since 2017, to conduct cryptojacking attacks. With the emergence of new Remote Code Execution (RCE) vulnerabilities in ubiquitous libraries, widespread cryptocurrency mining attacks have become prevalent, often employing fileless techniques. This paper provides a comprehensive analysis of PowerShell scripts of fileless cryptojacking, dissecting the common malicious patterns based on the MITRE ATT&CK framework.

Related papers

• PhantomSkill: Malicious Code Injection in Agent Skill Ecosystems [8.017582494003564]
  PhantomSkill is an attack framework that hides malicious behavior in a skill's auxiliary resources.<n>VulMask rewrites overt malicious scripts into vulnerability-shaped implementations whose malicious behavior is activated only under attacker-controlled trigger conditions.<n>Our results show that skill ecosystems require resource-level vetting, execution-time containment, and security policies that treat exploitable vulnerabilities in agent skills as potential malicious payloads.
  arXiv  Detail & Related papers  (2026-06-17T15:33:41Z)
• From Prompt Injection to Persistent Control: Defending Agentic Harness Against Trojan Backdoors [89.92617739143846]
  We introduce ClawTrojan, a benchmark designed to identify multi-step trojan attacks in local agentic harnesses.<n>We propose DASGuard, which scans control-like text in sensitive local files, traces its origin, and removes control content that does not originate from a trusted source.<n>Our results show that DASGuard achieves strong dynamic defense by combining runtime attack blocking with sanitized commits to the workspace.
  arXiv  Detail & Related papers  (2026-05-29T09:19:07Z)
• ShieldNet: Network-Level Guardrails against Emerging Supply-Chain Injections in Agentic Systems [56.613157564882925]
  Malicious behaviors are embedded in seemingly benign tools, silently hijacking agent execution, leaking sensitive data, or triggering unauthorized actions.<n>Despite their growing impact, there is currently no comprehensive benchmark for evaluating such threats.<n>We propose ShieldNet, a network-level guardrail framework that detects supply-chain poisoning by observing real network interactions.
  arXiv  Detail & Related papers  (2026-04-06T05:15:00Z)
• Detecting PowerShell-based Fileless Cryptojacking Attacks Using Machine Learning [0.09320657506524148]
  cryptojacking attacks have become effective with stealthy techniques based on Syn-based exploitation in Windows OS environments.<n> Abstracttax Tree (AST)-based fine-tuned CodeBERT achieved a high recall rate.
  arXiv  Detail & Related papers  (2026-02-20T15:32:15Z)
• CryptoGuard: Lightweight Hybrid Detection and Response to Host-based Cryptojackers in Linux Cloud Environments [9.40606834287371]
  CryptoGuard is a lightweight hybrid solution that combines detection and remediation strategies to counter cryptojackers.<n>It decomposes the classification task into a two-phase process, leveraging deep learning models to identify suspicious activity with high precision.<n>It achieves average F1-scores of 96.12% and 92.26% across the two phases, and outperforms state-of-the-art baselines in terms of true and false positive rates.
  arXiv  Detail & Related papers  (2025-10-21T06:15:48Z)
• Cuckoo Attack: Stealthy and Persistent Attacks Against AI-IDE [64.47951172662745]
  Cuckoo Attack is a novel attack that achieves stealthy and persistent command execution by embedding malicious payloads into configuration files.<n>We formalize our attack paradigm into two stages, including initial infection and persistence.<n>We contribute seven actionable checkpoints for vendors to evaluate their product security.
  arXiv  Detail & Related papers  (2025-09-19T04:10:52Z)
• Evasive Ransomware Attacks Using Low-level Behavioral Adversarial Examples [0.0]
  This paper introduces the concept of low-level behavioral adversarial examples and its threat model of evasive ransomware.<n>We formulate the method and the threat model to generate the optimal source code of evasive malware.<n>We then examine the method using the leaked source code of Conti ransomware with the micro-behavior control function.
  arXiv  Detail & Related papers  (2025-08-12T05:45:28Z)
• ELBA-Bench: An Efficient Learning Backdoor Attacks Benchmark for Large Language Models [55.93380086403591]
  Generative large language models are vulnerable to backdoor attacks. $textitELBA-Bench$ allows attackers to inject backdoor through parameter efficient fine-tuning. $textitELBA-Bench$ provides over 1300 experiments.
  arXiv  Detail & Related papers  (2025-02-22T12:55:28Z)
• SCORE: Syntactic Code Representations for Static Script Malware Detection [9.502104012686491]
  Server-side script attacks can steal data, compromise credentials, and disrupt operations. We propose novel feature extraction and deep learning (DL)-based approaches for static script malware detection. Our approach achieves a true positive rate (TPR) up to 81% higher than leading signature-based antivirus solutions.
  arXiv  Detail & Related papers  (2024-11-12T20:58:04Z)
• BaThe: Defense against the Jailbreak Attack in Multimodal Large Language Models by Treating Harmful Instruction as Backdoor Trigger [67.75420257197186]
  In this work, we propose $textbfBaThe, a simple yet effective jailbreak defense mechanism.<n>Jailbreak backdoor attack uses harmful instructions combined with manually crafted strings as triggers to make the backdoored model generate prohibited responses.<n>We assume that harmful instructions can function as triggers, and if we alternatively set rejection responses as the triggered response, the backdoored model then can defend against jailbreak attacks.
  arXiv  Detail & Related papers  (2024-08-17T04:43:26Z)
• h4rm3l: A Dynamic Benchmark of Composable Jailbreak Attacks for LLM Safety Assessment [48.5611060845958]
  We propose a novel benchmark of composable jailbreak attacks to move beyond static datasets and of attacks and harms. We use h4rm3l to generate a dataset of 2656 successful novel jailbreak attacks targeting 6 state-of-the-art (SOTA) open-source and proprietary LLMs. Several of our synthesized attacks are more effective than previously reported ones, with Attack Success rates exceeding 90% on SOTA closed language models.
  arXiv  Detail & Related papers  (2024-08-09T01:45:39Z)
• ShadowCode: Towards (Automatic) External Prompt Injection Attack against Code LLMs [56.46702494338318]
  This paper introduces a new attack paradigm: (automatic) external prompt injection against code-oriented large language models.<n>We propose ShadowCode, a simple yet effective method that automatically generates induced perturbations based on code simulation.<n>We evaluate our method across 13 distinct malicious objectives, generating 31 threat cases spanning three popular programming languages.
  arXiv  Detail & Related papers  (2024-07-12T10:59:32Z)
• PowerPeeler: A Precise and General Dynamic Deobfuscation Method for PowerShell Scripts [17.378929798013303]
  Cyber attackers often employ diverse techniques to obfuscate malicious scripts. Existing deobfuscation tools suffer from the limitation of static analysis. PowerPeeler is the first dynamic script deobfuscation approach at the instruction level.
  arXiv  Detail & Related papers  (2024-06-06T12:55:50Z)
• Understanding crypter-as-a-service in a popular underground marketplace [51.328567400947435]
  Crypters are pieces of software whose main goal is to transform a target binary so it can avoid detection from Anti Viruses (AVs) applications. The crypter-as-a-service model has gained popularity, in response to the increased sophistication of detection mechanisms. This paper provides the first study on an online underground market dedicated to crypter-as-a-service.
  arXiv  Detail & Related papers  (2024-05-20T08:35:39Z)
• LeapFrog: The Rowhammer Instruction Skip Attack [5.285478567449658]
  We present a new type of Rowhammer gadget, called a LeapFrog gadget, which allows an adversary to subvert code execution. The LeapFrog gadget manifests when the victim code stores the Program Counter (PC) value in the user or kernel stack. This research also presents a systematic process to identify LeapFrog gadgets.
  arXiv  Detail & Related papers  (2024-04-11T16:10:16Z)
• LOTUS: Evasive and Resilient Backdoor Attacks through Sub-Partitioning [49.174341192722615]
  Backdoor attack poses a significant security threat to Deep Learning applications. Recent papers have introduced attacks using sample-specific invisible triggers crafted through special transformation functions. We introduce a novel backdoor attack LOTUS to address both evasiveness and resilience.
  arXiv  Detail & Related papers  (2024-03-25T21:01:29Z)
• DRSM: De-Randomized Smoothing on Malware Classifier Providing Certified Robustness [58.23214712926585]
  We develop a certified defense, DRSM (De-Randomized Smoothed MalConv), by redesigning the de-randomized smoothing technique for the domain of malware detection. Specifically, we propose a window ablation scheme to provably limit the impact of adversarial bytes while maximally preserving local structures of the executables. We are the first to offer certified robustness in the realm of static detection of malware executables.
  arXiv  Detail & Related papers  (2023-03-20T17:25:22Z)
• Being Single Has Benefits. Instance Poisoning to Deceive Malware Classifiers [47.828297621738265]
  We show how an attacker can launch a sophisticated and efficient poisoning attack targeting the dataset used to train a malware classifier. As opposed to other poisoning attacks in the malware detection domain, our attack does not focus on malware families but rather on specific malware instances that contain an implanted trigger. We propose a comprehensive detection approach that could serve as a future sophisticated defense against this newly discovered severe threat.
  arXiv  Detail & Related papers  (2020-10-30T15:27:44Z)
• Adversarial EXEmples: A Survey and Experimental Evaluation of Practical Attacks on Machine Learning for Windows Malware Detection [67.53296659361598]
  adversarial EXEmples can bypass machine learning-based detection by perturbing relatively few input bytes. We develop a unifying framework that does not only encompass and generalize previous attacks against machine-learning models, but also includes three novel attacks. These attacks, named Full DOS, Extend and Shift, inject the adversarial payload by respectively manipulating the DOS header, extending it, and shifting the content of the first section.
  arXiv  Detail & Related papers  (2020-08-17T07:16:57Z)
• Explanation-Guided Backdoor Poisoning Attacks Against Malware Classifiers [12.78844634194129]
  Training pipelines for machine learning based malware classification often rely on crowdsourced threat feeds. This paper focuses on challenging "clean label" attacks where attackers do not control the sample labeling process. We propose the use of techniques from explainable machine learning to guide the selection of relevant features and values to create effective backdoor triggers.
  arXiv  Detail & Related papers  (2020-03-02T17:04:38Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.