Hackers Exploit Samsung MagicINFO Flaw to Compile Cryptominer On-System
Attackers leveraged a vulnerability in Samsung's MagicINFO software to gain initial access, then compiled a Monero cryptominer directly on the victim's Windows system, bypassing traditional malware delivery.
Cybercriminals have exploited a critical vulnerability in Samsung's MagicINFO software, identified as CVE-2025-4632, to infiltrate Windows systems and subsequently construct a cryptocurrency miner on the compromised machines. This novel approach, detailed by Huntress, involved compiling the Monero miner directly on the victim's hardware rather than deploying a pre-built executable, a method that generated conspicuous alerts potentially aiding in early detection.
The intrusion began in early September 2026 when attackers utilized the file-writing flaw within MagicINFO Premium, software commonly used for managing digital signage. This vulnerability allows an attacker to write files with system privileges, providing a critical foothold. The attackers proceeded to install a remote access tool, establish a new administrator account, and disable Microsoft Defender, paving the way for their cryptomining operation.
Investigators traced the initial access back to CVE-2025-4632, a flaw Samsung had previously addressed in May 2025. This vulnerability was particularly concerning given an earlier incomplete fix for a related MagicINFO issue, CVE-2024-7399, underscoring the need for prompt patching of internet-facing installations.
Despite the initial remediation advice, the attackers demonstrated persistence, re-exploiting the vulnerable service eight days later. They attempted to download the legitimate remote access program AnyDesk three times, with the third attempt succeeding after initial blocks by Microsoft Defender. The attackers then secured their access by setting a password for the tool, effectively gaining practical control over the compromised system.
With their access secured, the intruders proceeded to create a local administrator account and disable Microsoft Defender through Windows settings. These actions were crucial for maintaining persistence and obscuring their subsequent malicious activities. The disabling of the antivirus software made it significantly harder for defenders to detect the mining operation.
The most unusual aspect of this attack was the method used to deploy the cryptominer. Instead of downloading a ready-made miner, the attackers initiated a miner builder from the victim's Documents folder. This builder then launched legitimate Windows development utilities and C compilers, compiling the miner directly on the system. While this method generated significant, albeit unusual, alerts due to the compiler activity, it may have allowed the attackers to tailor the miner to the specific hardware.
Following the compilation, the miner began connecting to a public mining pool, utilizing the host's CPU and potentially its graphics processing unit to mine Monero. The mining activity was observed appearing under the Windows Explorer process, indicating that malicious code had been injected into a legitimate system process. Huntress recommends that organizations promptly patch internet-facing MagicINFO installations, monitor for repeated attempts to download remote access tools, and investigate unexpected compiler activity or changes to antivirus settings.
This incident highlights the evolving tactics of threat actors who are not only exploiting known vulnerabilities but also creatively repurposing system tools and processes to achieve their objectives. The direct compilation of malware on victim systems presents a unique detection challenge, emphasizing the importance of behavioral analysis and monitoring for anomalous system activity beyond traditional signature-based detection.