🚨 Hackers are hijacking misconfigured Docker APIs to run crypto miners—through the Tor network.

They mount the host OS, enable root SSH access, and drop XMRig—all while staying anonymous.

CheckDot is SAFU research CheckDot .