Hackers Hide PowerShell Malware in Registry, PNG and WAV Files to Deploy XMRig Miner

Researchers have uncovered a multi-stage cryptomining campaign that uses PowerShell, Registry-stored payloads, DNS TXT records, PNG images, and WAV audio files to conceal malware and deploy an XMRig-based cryptocurrency miner on compromised Windows systems. The activity was first identified after repeated alerts involving suspicious PowerShell execution. Initial analysis showed that the malware launched PowerShell with -NoProfile and execution-policy bypass settings before…

Diamond Model