From poisoned search results to GPU mining: A cryptojacking campaign abusing ScreenConnect and Microsoft .NET utilities
2026-05-27T02:52:16Z•38a2a47f1098d2f0f864f0d3e0954ca2033190cec32f3b565b6fa806a9fc3748
AI chatbot abuseConnectWise ScreenConnectGPU miningMicrosoft .NETSEO poisoningScreenConnectcoinminercryptojackingdrive-bymalicious domainsmalicious search resultspost‑exploitationthreat intel
What happened
Microsoft disclosed a cryptojacking campaign that uses SEO-poisoned search results and malicious sites (some surfaced by AI chatbots) to infect high-performance PCs with GPU miners. The actors abuse remote‑access tooling (ScreenConnect) and legitimate Microsoft .NET utilities to deliver and persist coin‑mining payloads. Microsoft analyzed the chain, detection signals, and mitigation steps.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- microsoft_security_blog
- Record identifier
- 38a2a47f1098d2f0f864f0d3e0954ca2033190cec32f3b565b6fa806a9fc3748
- Enrichment time
- 2026-05-27T02:52:16Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.