From poisoned search results to GPU mining: A cryptojacking campaign abusing ScreenConnect and Microsoft .NET utilities

2026-05-27T08:52:22Z•3827012a10a18c474e2ca79cf6d241453f42d22917cb01c2dd28db7b83864a8c

AI chatbotsConnectWise ControlGPU miningMicrosoft .NETSEO poisoningScreenConnectcryptojackingmalicious websitespoisoned search resultsremote access abuse

Open source link →

What happened

Microsoft details a cryptojacking campaign that uses SEO‑poisoned search results and AI chatbots to direct victims to malicious sites that deploy GPU miners. The operation abuses legitimate remote‑access tooling (ScreenConnect/ConnectWise) and Microsoft .NET utilities to deploy and run mining payloads on high‑performance PCs.

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID: microsoft_security_blog
Record identifier: 3827012a10a18c474e2ca79cf6d241453f42d22917cb01c2dd28db7b83864a8c
Enrichment time: 2026-05-27T08:52:22Z
AI-assisted enrichment: Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.

← Back to published records