Security researchers at Huntress have uncovered an unusual attack in which a threat actor compiled a cryptocurrency miner directly on a victim’s computer, rather than simply dropping a ready-made one, and in doing so generated so much activity that the intrusion stood out.
The incident began in early September 2026 with the exploitation of CVE-2025-4632, a vulnerability in Samsung MagicINFO, the content management software used to run digital signage. The flaw, which lets an attacker write arbitrary files with system-level privileges, was fixed in May 2025 after an earlier bug (CVE-2024-7399) whose fix proved incomplete.
Despite the organisation being alerted to the initial compromise and advised on remediation, the same endpoint was flagged again eight days later for fresh malicious activity tied to the same access route.
Third time lucky
According to Huntress, the attacker made three attempts to download the AnyDesk remote access tool. Microsoft Defender blocked the first two attempts, which used the Windows utility certutil and PowerShell, respectively. The third succeeded.
Once AnyDesk was installed, the attacker set a password for it, created a new local administrator account named “oldadministrator” using the same password, and then disabled Microsoft Defender.
Anything but silent
With defences switched off, the attacker ran “Silent XMR Miner Builder”, a tool likely derived from the open-source SilentXMRMiner project, which builds miners for the Monero cryptocurrency. The builder launched a series of .NET utilities and C compilers on the machine to produce the final miner, which then connected to the public C3Pool mining pool while disguised as the Windows Explorer process.
Huntress noted that compiling a miner on the endpoint could let an attacker tailor it to the target machine, for example by optimising for its processor. Ironically, however, the burst of compiler activity from an unsigned program created conspicuous telemetry for defenders to spot.
While cryptominers are a common sight in incidents, the researchers described on-endpoint compilation as an outlier. They stressed that the miner itself is not the real threat: what matters is how the attacker got in.
Recommendations
Huntress advises organisations to patch internet-facing Samsung MagicINFO deployments promptly, treat repeated attempts to download remote access tools as a sign of compromise, and monitor for unexpected compiler activity rather than relying solely on detecting known mining binaries.
Legitimate Windows Explorer processes should never run with cryptocurrency mining arguments, the researchers added, making such command lines a useful detection opportunity.
The full analysis, including indicators of compromise, is available on the Huntress blog: https://www.huntress.com/blog/threat-actor-compiles-cryptominer
