Researchers detected what they believe is the first publicly known malicious crypto-mining campaign launched via the open-source media player Kodi.

This month, Slovakian IT security company ESET discovered malware hidden in XvBMC, a Dutch repository for third-party Kodi add-ons. Further analysis revealed that threat actors had initially infected two other repositories with the malware in December 2017 and January 2018. From those two sources, the malware spread to XvBMC and throughout the rest of the Kodi platform.

Windows and Linux users ended up running the final malware payload, a Monero cryptocurrency miner, by adding the URL of a malicious repository to their Kodi installation or installing a Kodi build that contained either a malicious repository or an infected add-on. No variants targeting Android or macOS users were detected by ESET.

At the time of disclosure, the malware had infected 4,774 users and generated approximately $6,700.

Why Are Attackers Capitalizing on Add-Ons?

Cybercriminals are increasingly abusing add-ons and scripting functionalities in response to the tightening of security measures for operating systems. The industry recently witnessed this trend in the form of bad actors leveraging Visual Basic for Applications (VBA) macros to spread malware.

In 2016, IBM Managed Security Services observed an attack campaign using VBA macros to deliver Locky ransomware. Last year, Fortinet researchers observed two attacks where threat actors leveraged VBA macros embedded in Excel attachments to spread Dyzap malware and a variant of Strictor ransomware.

The ESET researchers clarified that they don’t expect Kodi add-ons to become the “next VBA,” but they did say they “may be an indication of things to come.”

How to Prevent a Crypto-Mining Campaign

To limit the threat of cryptojacking, security experts recommend implementing controls to help identify mining activity and blocking known crypto-mining malware variants. Security teams should also consider using security information and event management (SIEM) and behavioral analytics to identify suspicious resource usage patterns.

Sources: ESET, Fortinet