Cybercriminals Hijack Unpatched Plex Servers to Run Cryptocurrency Mining and Proxy Networks

Security researchers have confirmed that a malicious code bundle dubbed "Plex2Shell" is being used to compromise Plex Media Server installations that are accessible from the public internet, turning them into covert cryptocurrency miners and proxy relays.

The exploit takes advantage of a series of unpatched vulnerabilities in the Plex2Shell component, a third‑party script that some administrators have added to extend Plex functionality. When the vulnerable script is triggered, it silently downloads and executes mining software alongside a lightweight proxy service, allowing attackers to both generate illicit crypto revenue and route traffic through the compromised host.

Plex Media Server, a popular solution for streaming movies, music and personal video collections across devices, is typically run on home networks or small‑business environments. While the core Plex application is regularly updated, many users expose the service to the internet for remote access without applying the latest security patches, creating an attractive target for threat actors. The Plex2Shell flaw specifically affects installations where the script is left in a default, world‑readable location, making it easy for remote code execution attempts.

Initial investigations traced the malicious payloads to mining pools that support popular coins such as Monero and Ethereum Classic. In addition to the mining process, the embedded proxy component can be leveraged to hide the origin of further attacks, potentially facilitating spam, credential stuffing, or additional ransomware distribution campaigns. Because the mining activity runs at low CPU priority, many victims may not notice a performance dip, allowing the abuse to persist for weeks or months.

Security experts urge Plex administrators to take immediate remedial steps. The primary recommendation is to update Plex Media Server to the latest version, which includes hardening measures that block the known exploit vectors. Users should also audit their installation directories for any leftover Plex2Shell files, remove them, and verify that remote access ports are secured behind a VPN or limited to trusted IP addresses. Enabling two‑factor authentication on Plex accounts and employing network firewalls can further reduce exposure.

Industry analysts note that the incident underscores a broader trend of attackers repurposing consumer‑grade media servers as low‑cost compute nodes. As streaming services become ubiquitous, the attack surface expands, especially when users prioritize convenience over security. The episode serves as a reminder that even seemingly innocuous home‑run applications can be weaponized if left unpatched.

Looking ahead, the Plex development team has pledged to release additional hardening updates and to improve documentation around safe remote access configurations. Meanwhile, cybersecurity firms are monitoring underground forums for variants of the Plex2Shell tool, anticipating that threat actors may adapt the code to target other popular self‑hosted platforms. Users who suspect compromise are advised to review system logs for unexpected outbound connections and to consider resetting compromised credentials.