From poisoned search results to GPU mining: A cryptojacking campaign abusing ScreenConnect and Microsoft .NET utilities

Microsoft details a widespread cryptojacking campaign that uses SEO-poisoned search results and malicious sites (sometimes surfaced by AI chatbots) to compromise high-performance Windows hosts and deploy GPU miners. The threat chain abuses ConnectWise/ScreenConnect remote‑access tooling and legitimate Microsoft .NET utilities to install and execute coin‑mining payloads, prioritizing systems with powerful GPUs. The campaign emphasizes drive‑by/SEO delivery, remote‑access abuse for persistence and control, and opportunistic targeting of high-value compute resources.