Not even ordering pizza is safe from the browser crypto-mining scourge

Coinhive API increasingly pops up in top 3 million websites

A total of 2,531 of the top 3 million websites (1 in 1,000) are running the Coinhive miner, according to new stats from analytics firm Red Volcano.

BitTorrent sites and the like were the main offenders but the batch also included the Ecuadorian Papa John's Pizza website [see source code].

JavaScript-based Coinhive crypto-mining software on websites is bad news for surfers because the technology can suck up power and resources without user consent.

Coinhive launched a service in September that allowed mining of a digital currency called Monero directly within a web browser. The simplicity of the Coinhive API integration made the approach successful but partly due to several initial oversights – most notably through a failure to enforce an opt-in process to establish user consent – the technology has been widely abused.

https://regmedia.co.uk/2017/11/08/drive_by_mining.jpg

Some less than salubrious web portals started to run the Coinhive API in non-throttled mode, tying up users' machines in the process. In other cases hackers planted code crypto-mining software on third-party websites, a practice known as either crypto-jacking or drive-by mining.

https://regmedia.co.uk/2017/11/08/co...=357&infer_y=1

Instances of crypto-mining code on webpages or buried within rogue smartphone apps keep rolling in.

Security vendor Ixia warns two games on the Google Play store, Puzzle and Reward Digger, by AK Games are actively mining cryptocurrency from thousands of infected Android mobile phones.

Android cryptocurrency mining malware can be quite lucrative for cybercriminals. For instance, total profits earned on one specific Magicoin wallet are equal to $1,150 at current exchange rates, according to Ixia's report. This makes cryptominers the next generation of adware software, Ixia concluded.

Elsewhere Netskope discovered a Coinhive miner installed as a plugin on a tutorial webpage for Microsoft Office 365 OneDrive for Business. The offending website – https://www.sky-future[.]net – removed the Coinhive plugin after it was notified about the issue. "The tutorial webpage hosted on the website was saved to the cloud and then shared within an organisation," according to Netskope.

Microsoft told El Reg that its "security software detects and blocks this application". Ad blockers and antivirus programs have also added features that block browser mining but few security watchers think this alone will bring the issue to heel. The opportunity to coin in cryptocurrency by enslaving the machines of others is just too tempting for unscrupulous websites and black hats.

It's about stealing users data, but instead running a crypto miner while you are on that page. It slows down your PC and the longer you stay on the page the more money you make the. They should at least give you a discount on that pizza.