Cryptocurrency miners hidden in websites keep running in the background even when the browser window is closed.
The web administrators and hackers are observing some JavaScript-based cryptocurrency miners due to the fast increase in the prices of the cryptocurrency. The scripts exploit the CPU power of their visitor’s PC to mine Bitcoin or other cryptocurrencies.
According to security experts, there are websites which use a simple technique to keep their cryptocurrency mining JavaScript under the radar and secretly running in the background even when the web browser is closed.
Most often, the scripts are used as an alternative monetization model to banner adverts. They are capable of mining the cryptocurrencies as long as the visitors are on their website and loose access to the computer processor and associated resources when the window is closed.
The technique leverages a hidden pop-under browser window which is opened by the mining window, fits behind the taskbar and hides behind the clock on Microsoft’s Windows computer. The hidden window is used to run the crypto-miner code consumes CPU cycles and power from the visitor’s computer until he will not notice the window and close it.
“The trick is that although the visible browser windows are closed, there is a hidden one that remains opened. This is due to a pop-under which is sized to fit right under the taskbar and hides behind the clock.” a security blog post reads.
“The hidden window’s coordinates will vary based on each user’s screen resolution, but follow this rule:
- Horizontal position = ( current screen x resolution ) – 100
- Vertical position = ( current screen y resolution ) – 40
If your Windows theme allows for taskbar transparency, you can catch a glimpse of the rogue window. Otherwise, to expose it you can simply resize the taskbar and it will magically pop it back up.”
This technique is simple and efficient, difficult to be identified and able to bypass most ad-blockers. According to the experts, the cryptocurrency miners run from a crypto-mining engine hosted by Amazon Web Servers.
“This type of pop-under is designed to bypass adblockers and is a lot harder to identify because of how cleverly it hides itself. Closing the browser using the “X” is no longer sufficient.” the post continues.
“The more technical users will want to run Task Manager to ensure there is no remnant running browser processes and terminate them. Alternatively, the taskbar will still show the browser’s icon with slight highlighting, indicating that it is still running.”
To remain under the radar, the code of cryptocurrency miners runs in the hidden browser maintains CPU usage threshold to a medium level. The scripts work on the latest version of Google’s Chrome web browser running on the most recent versions of Microsoft’s Windows 7 and Windows 10.
PC users can notice miner windows by looking for any browser windows in the taskbar or running the Task Manager on their computer to make sure there is no running browser processes that are consuming CPU resources.
The web browser extension No Coin can block in-browser cryptocurrency miners automatically, however, No Coin does not support Internet Explorer, Microsoft Edge, and Apple Safari yet.
