The Los Angeles Times Cryptomining Attack

The Los Angeles Times website was covertly mining cryptocurrency on visitors' devices after hackers injected CoinHive's Monero-mining code. This happened due to an unprotected Amazon S3 storage bucket, which allowed unrestricted public access, letting hackers modify site files. They inserted the mining script on the newspaper's interactive homicide map, causing visitors to unknowingly mine cryptocurrency for the attackers.

Others discovered this vulnerability, leaving a warning note titled "BugDisclosure.txt" urging the LA Times to secure the bucket. The open permissions allowed hackers to add potentially more harmful code, like password-stealing malware, though only the mining script was found.