Threat actors part of the proxyjacking campaign exploited Selenium Grid servers’ “goog:chromeOptions” configuration to facilitate deployment of a base64-encoded Python script, which enabled the retrieval of an open-source GSocket reverse shell and the eventual deployment of the IPRoyal Pawns residential proxy service and EarnFM proxyware tool, reported Cado Security researchers.

Source: SC Magazine