Back Securityaffairs.Co

Wormable XMRig campaign leverages BYOVD and timed kill switch for stealth

Securityaffairs.Co •Pierluigi Paganini • February 23, 2026

A wormable cryptojacking campaign spreads via pirated software, using BYOVD and a time-based logic bomb to deploy a custom XMRig miner. Researchers uncovered a wormable cryptojacking campaign that spreads through pirated software bundles to deploy a custom XMRig miner. The attack uses a BYOVD exploit and a time-based logic bomb to evade detection and maximize […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Wormable XMRig Cryptojacking Campaign Uses BYOVD Techniques A wormable cryptojacking campaign has been identified, leveraging pirated software to deploy a custom XMRig miner. The attack utilizes BYOVD techniques and incorporates a time-based logic bomb to enhance stealth and evade detection. Affected systems include those running counterfeit software packages that facilitate the infection process. 2 sources 33

Extracted Entities

Wormable XMRig campaign leverages BYOVD and timed kill switch for stealth

The full story

Extracted Entities

Attack Types (2)

Campaigns (1)

Malware (1)

MITRE ATT&CK (2)