Monero is the most popular coin among cryptojackers, who mine cryptocurrencies using hidden mining viruses. Scientists from the Carlos III University of Madrid and King's College London reached this conclusion after conducting a study. The next most popular cryptocurrency among cryptojackers is Bitcoin. Previously, hackers tried mining other altcoins, but returned to XMR and BTC for reasons of profitability. According to the study's results, more than 4% of XMR coins of the current market volume were mined using virus software. Although the exact amount of income received depends on when the criminals cash out the money, the researchers calculated that almost 57 million US dollars (1.2 million dollars a month) was stolen over the past four years. The study also showed that the overwhelming majority of mined XMR was directed straight into a single cryptocurrency mining pool – crypto-pool. To date, its members mine no less than 435,689 XMR (that is almost 47 million US dollars).

The researchers reported: «By our estimates, around 720 thousand XMR coins ($57 million) were mined over the course of 2,218 active virus campaigns. A single attack collected 163 thousand XMR ($18 million)… And this campaign is still active at the time of writing».

At the same time, the analysts do not report what share of the cryptocurrencies the attackers converted into fiat currencies.

In the course of the study, 4.4 million samples of malicious software were examined over a 12-year period, from 2007 to 2018, and 1 million mining viruses were identified, the report states.

The tactics for spreading mining viruses vary, but usually «droppers» and miners of the claymore and xmrig type are stored on the basis of legitimate infrastructure, for example, in Dropbox cloud storage or the GitHub resource.

In terms of popularity among hackers, Bitcoin follows after Monero. In 2013-2014 the criminals «experimented» with altcoins, in particular Dogecoin and Litecoin, but then returned to BTC and XMR. Probably for reasons of profitability, the scientists believe.

The researchers managed to identify several thousand wallets associated with mining viruses, among which Monero wallets turned out to be almost twice as numerous as Bitcoin addresses.

At the end of November, specialists from the «Doctor Web» company reported the discovery of a Monero mining virus. In September the attackers managed to hack the MEGA Chrome extension and steal Monero private keys.