最新报道：Cybersecurity firm Darktrace has uncovered a new cryptojacking campaign designed to bypass Windows Defender and deploy cryptocurrency mining software. Darktrace researchers Keanna Grelicha and Tara Gould explained in a report shared with crypto.news that this cryptojacking campaign, first detected in late July, involves a multi-stage infection chain that quietly hijacks a computer's processing power to mine cryptocurrency. Researchers say the campaign specifically targets Windows-based systems by exploiting PowerShell, Microsoft's built-in command-line shell and scripting language, which allows bad actors to run malicious scripts and gain privileged access to the host system. These malicious scripts are designed to run directly in system memory (RAM), making them undetectable to traditional antivirus tools that typically rely on scanning files on the system's hard drive. The attackers then use the AutoIt programming language, a Windows tool commonly used by IT professionals to automate tasks, to inject a malicious loader into a legitimate Windows process, which then downloads and executes the cryptocurrency miner without leaving any visible traces on the system. As an additional defense, the loader is programmed to perform a series of environmental checks, such as scanning for signs of a sandbox environment and checking for antivirus products installed on the host. Execution will only proceed if Windows Defender is the only active protection. Furthermore, if the infected user account lacks administrative privileges, the program attempts to bypass User Account Control to gain elevated access. When these conditions are met, the program downloads and executes NBMiner, a well-known cryptocurrency mining tool that uses the computer's graphics processing unit to mine cryptocurrencies such as Ravencoin (RVN) and Monero (XMR). In this case, Darktrace was able to contain the attack through its autonomous response system by "blocking the device from establishing outbound connections and blocking specific connections to suspicious endpoints." "As cryptocurrencies continue to grow in popularity, as evidenced by the continued overvaluation of the global cryptocurrency market capitalization (nearly $4 trillion at the time of writing), threat actors will continue to view cryptocurrency mining as a lucrative venture," Darktrace researchers wrote. Back in July, Darktrace flagged a separate campaign in which bad actors used sophisticated social engineering tactics (such as impersonating real companies) to trick users into downloading modified software that deployed cryptocurrency-stealing malware. Unlike the aforementioned cryptojacking schemes, this method targeted both Windows and macOS systems and was carried out by unwitting victims themselves, who believed they were interacting with company insiders.