Users of Kodi Media Player Targeted by Cryptomining Malware

Users of Kodi Media Player Targeted by Cryptomining Malware

Third-party add-ons were found to contain malware targeting Windows and Linux users

Users of the Kodi, beware! ESET researchers reported Thursday that they had found multiple add-ons for the popular media player containing malware designed to force users’ systems to mine cryptocurrency.

Kodi is a free downloadable media player intended for use with TVs, but does not stream any content on its own, relying on add-ons such as “Gaia” and “XvBMC” to provide content. These two, along with another popular repository called “Bubbles,” were the first three add-ons discovered to be infected with the malware.

All three of these repositories are currently offline, having been subject to copyright complaints, due to the prevalence of their use, and by extension Kodi’s, to stream pirated content. The malware purportedly takes advantage of the update verification system to “fingerprint” a user’s Operating System, and later uses this back door to install a coinminer, malware that uses the victim’s CPU to mine for cryptocurrency.

Nadav Avital, threat researcher at Imperva, a cybersecurity company, said that cyber criminals targeting Kodi isn’t surprising. “Cyber criminals are always looking to expand their target cycle in order to make more money,” Avital said. “In the past, we've seen rogue crypto miner malware infecting browsers, databases, management systems, cache systems and more.”

The criminals’ efforts were to mine the cryptocurrency Monero, and data obtained by ESET led them to believe they had infected at least 4,700 systems, and mined almost $7,000 worth of Monero. Most of the affected systems are in the United States, by far the region where Kodi’s user base is the largest.

This is actually the second incident of its kind, with the first malware campaign being discovered in 2017. In that instance, Kodi users found their systems unwittingly recruited into helping with DDoS (Distributed Denial of Service) attacks.

About the Author

Jordan Lutke is an intern with 1105 Media.

Featured

New Products

  • Mobile Safe Shield

    Mobile Safe Shield

    SafeWood Designs, Inc., a manufacturer of patented bullet resistant products, is excited to announce the launch of the Mobile Safe Shield. The Mobile Safe Shield is a moveable bullet resistant shield that provides protection in the event of an assailant and supplies cover in the event of an active shooter. With a heavy-duty steel frame, quality castor wheels, and bullet resistant core, the Mobile Safe Shield is a perfect addition to any guard station, security desks, courthouses, police stations, schools, office spaces and more. The Mobile Safe Shield is incredibly customizable. Bullet resistant materials are available in UL 752 Levels 1 through 8 and include glass, white board, tack board, veneer, and plastic laminate. Flexibility in bullet resistant materials allows for the Mobile Safe Shield to blend more with current interior décor for a seamless design aesthetic. Optional custom paint colors are also available for the steel frame.

  • EasyGate SPT and SPD

    EasyGate SPT SPD

    Security solutions do not have to be ordinary, let alone unattractive. Having renewed their best-selling speed gates, Cominfo has once again demonstrated their Art of Security philosophy in practice — and confirmed their position as an industry-leading manufacturers of premium speed gates and turnstiles.

  • AC Nio

    AC Nio

    Aiphone, a leading international manufacturer of intercom, access control, and emergency communication products, has introduced the AC Nio, its access control management software, an important addition to its new line of access control solutions.