What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Publicly reachable Selenium Grid services without effective access controls can let outsiders invoke WebDriver actions on registered nodes, including actions that lead to command execution. Wiz Research reported a campaign it named SeleniumGreed in July 2024 that used exposed Grid instances to launch Python, open reverse shells, and deploy modified Monero miners. Later 2024 reports described separate cryptomining and proxyjacking campaigns. Those reports document activity in 2024; they do not establish that the campaigns remain active in October 2026.
What happened, and is the attack still ongoing?
Wiz Research said SeleniumGreed was active when it published its analysis on July 25, 2024. The attackers targeted publicly accessible Selenium Grid services and used WebDriver configuration to run code on affected nodes. In December 2024, Darktrace/Cado Security Labs and CERT-EU described additional campaigns abusing misconfigured Grid instances for cryptomining and proxyjacking.
These reports show repeated abuse of an exposure pattern; they do not establish one continuous campaign, a common operator, or activity in 2026. The actor behind the SeleniumGreed campaign was unknown in the reporting. The evidence describes insecure exposure and misuse of service functionality, not a named CVE or proof that Selenium Grid itself is malware.
Why an exposed Grid can put its nodes at risk
Selenium Grid coordinates browser tests across a hub and registered nodes, allowing teams to distribute workloads across machines, browsers, and browser versions. Those nodes can launch browser instances and interact with the underlying system. Wiz described Grid as intended for internal networks and noted that its default configuration did not enable authentication. If an untrusted party can reach a hub without suitable access controls, that party may be able to issue WebDriver operations against its nodes.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Wiz reported that WebDriver can interact with the node, including reading or downloading files and executing binaries. In its SeleniumGreed analysis, the attackers configured Chrome options to use Python as the browser binary and pass a script argument. That provided a route to command execution on the exposed instances they targeted. The issue is therefore not limited to an old-version bug: Wiz said remote command execution was possible on newer Grid versions when they were inadequately secured, while reporting no evidence that the campaign was actively exploiting those newer versions at the time.
How the reported campaigns worked
SeleniumGreed: the July 2024 report
- Find reachable Grid services. The attackers sent requests to publicly accessible Selenium Grid instances.
- Use WebDriver to launch Python. The reported Chrome configuration caused Python to run with a supplied script.
- Establish remote access and fetch payloads. Python opened a reverse shell, and scripts fetched and ran a modified XMRig Monero miner.
- Use additional hosts in the operation. Wiz said other compromised Selenium hosts were used to stage payloads or act as mining-pool proxies.
Wiz also reported evasion techniques including suppressing interactive shell history, timestomping, a custom CATS packer header, and running processes with nohup. Its article lists miner hashes and network indicators. Those are historical observables, not proof of current activity; validate them against current threat intelligence and your environment before using them as a basis for blocking or incident conclusions. See Wiz Research’s technical account and indicators.
Later 2024 campaigns
Separate reporting summarized by CERT-EU and published by Darktrace/Cado described two other campaigns against misconfigured Grid instances. Their reported payloads included cryptominers and proxyjacking tools, with Python-script injection, reverse shells, and services including IPRoyal and TraffMonetizer. These reports should not be conflated with SeleniumGreed: they do not establish that the same operator, infrastructure, or payloads were involved. See Darktrace/Cado’s December 2024 analysis and CERT-EU’s September 2024 Cyber Brief.
What the reported exposure figures do—and do not—show
Wiz published several scale indicators in 2024. They are historical query and usage figures, not a current global inventory or a measurement of active compromise.
Rank #3
| Reported figure | What it measured | How to interpret it |
|---|---|---|
| More than 15,000 unique IPs | Wiz’s 2024 FOFA query for Selenium Grid v3.141.59 or earlier over the preceding year; the article said most were on default port 4444. | A reported scan result for that period, not a 2026 count or a count of confirmed victims. |
| Around 15,000 instances; more than 30,000 combined | Wiz’s separate 2024 query for newer versions and its combined total for the two query results. | Wiz said newer versions could also permit remote command execution when inadequately secured, but reported no evidence they were actively exploited by SeleniumGreed at publication. |
| Over 30% of cloud environments | Wiz’s 2024 data on environments where Selenium was present. | Presence of Selenium is not the same as an exposed or compromised Grid service. |
| Over 100 million pulls; more than 150,000 pulls per week on average | Wiz’s 2024 figures for the official selenium/hub Docker image. |
These were the article’s published figures, not current Docker Hub counts or evidence of exposure. |
The figures above are from Wiz Research’s July 25, 2024 report. They do not show how many Grid services are exposed today. The later campaign reports likewise do not establish current prevalence.
How to check whether your Selenium Grid is exposed or compromised
Check exposure first
- Inventory Grid hubs and nodes across cloud accounts, data centers, test environments, and developer infrastructure.
- Use external network or vulnerability scanning to identify services reachable from outside the networks that are meant to use them. Confirm findings against your own assets; a scan result is not proof of compromise.
- Review network policy and firewall rules for inbound access to the hub and node services. Do not treat an unusual port or a non-default version as an access control.
Look for suspicious activity on nodes
- Investigate unexpected Python or shell processes launched by browser-related services, particularly when followed by outbound connections.
- Check for reverse-shell behavior, downloaded or newly created executables, unfamiliar sustained high-CPU processes, and unexpected mining-pool or proxy-service traffic.
- Review process, network, system, and application logs for unusual activity around the time of any suspicious process or connection. The listed behaviors are investigation clues, not unique proof of this campaign.
How to secure Selenium Grid
| Control | What to do | Risk addressed |
|---|---|---|
| Keep Grid private | Place hubs and nodes on internal or otherwise restricted networks. Permit inbound connections only from trusted sources that need Grid access. | Reduces the chance that an unauthorised internet user can invoke WebDriver operations. |
| Enable authentication | Enable authentication on the Grid service and apply appropriate access controls. Do not rely on obscurity or changing the port. | Helps prevent reachable but unauthorised users from using the service. |
| Restrict outbound traffic | Allow nodes to connect only to destinations required for testing and operations; investigate unexplained outbound connections. | Can limit communication used for payload retrieval, reverse shells, mining, or proxying. |
| Monitor runtime behavior | Alert on unexpected Python or shell execution, reverse-shell patterns, unfamiliar downloads, and persistent mining-like processes on nodes. | May help detect misuse that network exposure controls did not prevent. |
| Reassess exposure regularly | Repeat asset inventory and external exposure checks when infrastructure or network policies change. | Helps catch forgotten or newly reachable Grid services. |
These are complementary controls: authentication does not make an internet-facing service safe by itself, and scanning identifies reachability rather than stopping exploitation. Wiz describes runtime detection as a control and discusses its own sensor; that vendor account is not an independent comparison of detection products.
Quick Recap
Best Value
What to do if you suspect a node was compromised
- Contain access. Restrict external and unnecessary internal access to the affected Grid hub and nodes. If containment could disrupt critical operations, coordinate it with the service owner and incident responders.
- Preserve evidence. Preserve relevant logs, host and process evidence, and network observations before rebuilding or cleaning the system where feasible.
- Investigate scope. Determine which hubs and nodes were reachable, what processes ran, what files were created or downloaded, and whether there was suspicious outbound traffic. Do not conclude that a host is clean solely because a published indicator was absent.
- Eradicate and restore safely. Remove unauthorised components, address the exposure and access-control gaps, and restore nodes from trusted sources where appropriate. Verify that replacement or rebuilt services remain restricted.
- Escalate when needed. Use qualified incident response or digital forensics support if you cannot establish the scope or safely contain the incident. The cited reporting mentions DFIR as an option but does not evaluate providers.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
