Researchers from potentially Google-bound Wiz uncovered an active campaign deploying malware under the guise of 404 error pages hosted on websites built using Google Sites.

Wiz, which is in the process of being acquired by Google for $32 billion, revealed details this week on what it dubbed "Soco404," an exploit using misconfigured cloud services to plant cryptomining malware across Linux and Windows systems. Wiz estimated the campaign is part of a broader crypto-scam infrastructure, with Soco404 a variant targeting exposed PostgreSQL instances.

As explained on the Wiz website, 404 HTML pages hosted on websites built using Google Sites act as “zombie hosts” to the malware, secretly containing encoded files that install the cryptominer. These seemingly harmless broken pages become the catalyst for Soca404 to begin mining the Monero cryptocurrency, churning CPU capacity and driving up cloud expenses.

Both Linux and Windows machines are being leveraged by the attackers, who tailor their methods to each platform.

On Linux, the malware quietly schedules itself to run regularly and hides in system settings to stay active. On Windows, meanwhile, it uses built-in tools such as PowerShell to download harmful files and turns off logging, making it harder to flag.

Wiz noted that domains linked to the campaign pose as fake cryptocurrency exchanges, suggesting ties to a larger crypto-scam operation.

The affected sites were taken down by Google after Wiz flagged the issue; there is no report on the reaction from Google to Wiz’s discoveries.

The tech giant, meanwhile, has yet to close its mega-acquisition of Wiz, with Department of Justice (DOJ) antitrust scrutiny posing a current hurdle.

Cryptomining is not a new threat to networking, seeing security responses from the likes of Google Cloud and Cisco over the years.

Meanwhile, Wiz research posits that nearly 90% of cloud environments self-host PostgreSQL instances, with one-third of those having at least one instance publicly exposed to the internet, meaning the exploit has a notably expansive attack surface.