Hackers Pose as Non-Profit Developers to Deploy Monero Mining Malware
2026-04-07T20:51:43Z•2220d31dc2c6bad941200cdfee13a396a14dde125b51d66361c8708172915cdd
UNC1069UNC4736ai-injectionbrowser-extensioncloudflarecmscredential-theftcryptominingdata-exfiltrationemdash-cms','workflow-automation','red-team','security-researchgrafanamalwaremoneronodejsnorth-koreanpmopen-source-securityphishingprivacyprompt-injectionqr-phishingsocial-engineeringsupply-chaintrackingvulnerability
What happened
Recent reporting highlights a range of high-impact cyber activity: attackers distributing Monero cryptomining malware via fake non‑profit installers and stealthy payload delivery; a critical “GrafanaGhost” flaw in Grafana’s AI components that enables indirect prompt‑injection and protocol‑relative URL bypasses to exfiltrate data; nation‑state actors (UNC4736 and UNC1069) conducting large thefts and supply‑chain/maintainer compromises (including a $285M Drift theft and targeted Node.js maintainer attacks via fake LinkedIn/Slack profiles); widespread phishing campaigns exploiting geopolitical (m
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- hackread
- Record identifier
- 2220d31dc2c6bad941200cdfee13a396a14dde125b51d66361c8708172915cdd
- Enrichment time
- 2026-04-07T20:51:43Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.