Cryptominer Indicators in Agent Content

How the attack works

An attacker gets content into an agent's workflow, such as a generated file, a fetched webpage, or a message the agent processes, that contains mining-related material. This can include the stratum protocol used to talk to mining pools, hostnames of known mining pools, references to mining software, or a browser-based cryptojacking script meant to run on a visitor's machine. The rule looks for these known patterns to catch an attempt to smuggle mining activity into agent-generated or agent-processed content. It does not by itself confirm that mining ran, only that the telltale markers appeared.

Netzilo detection

Why it matters

If unnoticed, this can lead to unauthorized use of computing resources for someone else's cryptocurrency mining, higher cloud or infrastructure costs, and in the browser-script case, visitors' machines being hijacked to mine on the attacker's behalf.

What you can do

• →Review any flagged content manually before it is deployed, published, or executed to confirm whether the mining reference is legitimate.
• →If you run blockchain or mining-related tooling that legitimately references pool URLs, document and allowlist those specific hostnames to reduce noise.
• →Restrict agents from writing directly to production web pages, scripts, or executable outputs without human review.
• →Monitor outbound network connections from systems running agent output for stratum protocol traffic or connections to known mining pool hosts.

Known benign look-alikes

• Legitimate cryptocurrency pool operators managing their own infrastructure
• Blockchain developer tools referencing pool URLs in configuration

Related threats