Attackers Compile Cryptominer on Victim Endpoint via Samsung MagicINFO Exploit

• •Attackers exploited CVE-2025-4632 in Samsung MagicINFO to gain access.
• •A cryptominer was compiled directly on the victim's machine, increasing detection risk.
• •Organizations should monitor for unexpected compiler activity and patch vulnerabilities.

In early September 2026, a threat actor exploited CVE-2025-4632, a vulnerability in Samsung MagicINFO, to compile a cryptominer directly on a victim's endpoint. The attack began with the installation of a rogue AnyDesk instance after multiple failed attempts, followed by creating a new local admin account and disabling Microsoft Defender. The attacker utilized the Silent XMR Miner Builder to compile the miner, which generated significant EDR telemetry, making the intrusion noticeable. Despite the organization being alerted to the initial compromise, the same endpoint was flagged again for malicious activity shortly thereafter. This incident highlights the importance of monitoring for unusual compiler activity and patching known vulnerabilities promptly.