Security researchers from Kaspersky and Securelist identified a major campaign in early 2025 targeting users—particularly in Russia—by disguising the miner as tools for bypassing internet restrictions (DPI bypass tools).
SilentCryptoMiner is based on the open-source miner and is highly specialized for evasion: Silent.Crypto.Miner.Builder.rar
Security experts recommend avoiding software downloads from unofficial sources, especially those that prompt you to disable security protections. Silent.Crypto.Miner.Builder.rar
Some versions include a "clipper" that monitors the clipboard for wallet addresses and replaces them with the attacker's address during transactions. Silent.Crypto.Miner.Builder.rar
It injects malicious code into legitimate system processes like dwm.exe or explorer.exe to remain hidden from users.