SELENIUMGREED: THREAT ACTORS EXPLOIT EXPOSED SELENIUM GRID SERVICES FOR CRYPTOMINING

Summary from the TLDR InfoSec newsletter

Wiz has detected a campaign that targets exposed Selenium Grid services. The attackers are using the Selenium WebDriver API to run a Python reverse shell to download a crypto miner. Selenium warns against exposing Selenium Grid to the public Internet and enabling authentication by default.