A Drupal 7.56 honeypot catches an attacker pulling down a JPEG that was really a script, connecting to a Monero pool and mining from the server itself.

A campaign injecting crypto-mining JavaScript into Drupal and other platforms, in one case wiring the block into every page on the site.