--- title: Cryptojacking Campaign Exploits DevOps APIs Using... description: A new cryptojacking campaign called JINX-0132 targets misconfigured DevOps servers including Docker, Gitea, HashiCorp Consul, and Nomad to mine... canonical: https://daily.dev/posts/cryptojacking-campaign-exploits-devops-apis-using-off-the-shelf-tools-from-github-d9gkfpraf twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Cryptojacking Campaign Exploits DevOps APIs Using Off-the-Shelf Tools from GitHub | daily.dev og:description: A new cryptojacking campaign called JINX-0132 targets misconfigured DevOps servers including Docker, Gitea, HashiCorp Consul, and Nomad to mine... og:url: https://daily.dev/posts/cryptojacking-campaign-exploits-devops-apis-using-off-the-shelf-tools-from-github-d9gkfpraf og:image: https://api.daily.dev/og/posts/D9gkFpRAf.png og:image:alt: Cryptojacking Campaign Exploits DevOps APIs Using Off-the-Shelf Tools from GitHub og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Cryptojacking Campaign Exploits DevOps APIs Using Off-the-Shelf Tools from GitHub **[The Hacker News](https://daily.dev/sources/thn)** · 3 min read · 1 upvotes · 0 comments ## Summary A new cryptojacking campaign called JINX-0132 targets misconfigured DevOps servers including Docker, Gitea, HashiCorp Consul, and Nomad to mine cryptocurrencies. Attackers exploit known vulnerabilities and misconfigurations, downloading tools directly from GitHub to avoid attribution. The campaign notably represents the first documented exploitation of Nomad misconfigurations in the wild, with compromised instances managing hundreds of clients worth tens of thousands of dollars monthly in computing resources. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- Tags: [#cyber](https://daily.dev/tags/cyber), [#devops](https://daily.dev/tags/devops), [#docker](https://daily.dev/tags/docker), [#hashicorp](https://daily.dev/tags/hashicorp) [View this post on daily.dev](https://daily.dev/posts/cryptojacking-campaign-exploits-devops-apis-using-off-the-shelf-tools-from-github-d9gkfpraf) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Cryptojacking Campaign Exploits DevOps APIs Using Off-the-Shelf Tools from GitHub","url":"https://daily.dev/posts/cryptojacking-campaign-exploits-devops-apis-using-off-the-shelf-tools-from-github-d9gkfpraf","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cryptojacking-campaign-exploits-devops-apis-using-off-the-shelf-tools-from-github-d9gkfpraf"},"datePublished":"2025-06-02T16:23:33.652Z","dateModified":"2025-06-03T11:29:28.712Z","description":"A new cryptojacking campaign called JINX-0132 targets misconfigured DevOps servers including Docker, Gitea, HashiCorp Consul, and Nomad to mine...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/435fa0600a6573414da8529f2fd7b4ad?_a=AQAEulh","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/435fa0600a6573414da8529f2fd7b4ad?_a=AQAEulh","isAccessibleForFree":true,"articleSection":"The Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/thn","url":"https://daily.dev/sources/thn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cryptojacking-campaign-exploits-devops-apis-using-off-the-shelf-tools-from-github-d9gkfpraf","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,devops,docker,hashicorp","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Hacker News","item":"https://daily.dev/sources/thn"},{"@type":"ListItem","position":3,"name":"Cryptojacking Campaign Exploits DevOps APIs Using Off-the-Shelf Tools from GitHub"}]} ```