Cloud Abuse at Scale: How Cybercriminals Exploit Free Tiers for Profit

Cloud Abuse at Scale: How Cybercriminals Exploit Free Tiers for Profit

Speakers: Miguel Hernandez, Sr. Threat Research Engineer, Sysdig

Conference: fwd:cloudsec Europe 2025

YouTube: https://www.youtube.com/watch?v=zcmpGW61wm0

Overview

Miguel Hernandez, a Senior Threat Research Engineer at Sysdig with over a decade in security research, presented findings from an 18-month investigation into a sprawling underground ecosystem that systematically abuses cloud provider free tiers for cryptomining profit. What began as routine threat hunting of malicious scripts evolved into mapping an entire supply chain — from automated account creation using stolen student identities and browser macros, to Telegram-based marketplaces selling cloud accounts, to structured training courses teaching free-tier abuse techniques. The research reveals that cloud free-tier abuse is not the work of isolated individuals but a coordinated, semi-professionalized industry.

Background

▶ Watch: Initial discovery of linked cryptomining scripts leading to hundreds of inter... (2:00)

Abuse of CI/CD platform free tiers for cryptomining has been documented since at least 2021, with isolated reports targeting individual platforms like GitLab, Azure DevOps, and GitHub Actions. These reports typically examined single-service abuse in isolation — one group hitting GitLab, another abusing Azure Pipelines — without attempting to map the broader ecosystem or identify whether the same actors were operating across multiple platforms.

Hernandez's research took a different approach. Starting from routine threat hunting of malicious scripts containing standard cryptomining evasion techniques — LD_PRELOAD injection, process hiding, kernel-level evasion — he followed the infrastructure links across hundreds of repositories and user accounts to construct a global view of the operation.

Key Findings

▶ Watch: iMacros browser automation revealed — automated Microsoft account creation an... (6:00)

Massive scale of automated account creation. The actors use iMacros, a browser automation extension, to create Microsoft/Outlook accounts at scale with randomized names, phone numbers, and emails. These accounts are then used to register GitHub accounts, which in turn unlock access to downstream services. The automation is remarkably simple — click-through macros that handle the entire registration flow.

Stolen student identities unlock premium credits. Actors use stolen Canvas IDs from real students to enroll GitHub accounts in the GitHub Student Developer Pack, which provides significantly more credits on cloud platforms like Azure, GCP, and others. This transforms a basic free-tier account into a premium resource.

Multi-hop obfuscation through educational platforms. Rather than registering directly with GCP, actors route through Coursera — using automated macros to enroll in Coursera courses that provide GCP lab access. They even use a shared valid credit card (stored in plaintext in a repository) to handle Coursera's 30-day trial enrollment requirement. Qwiklabs (now Cloud Skills Boost) and Google Cloud Skills Labs serve as additional intermediaries, providing temporary GCP projects where miners run inside Docker containers disguised as ML training jobs.

Docker containers disguised as training workloads. The cryptomining payload is hidden inside Docker containers built from legitimate Google Cloud lab templates. A repository named "horse-versus-human" — actually a Qwiklabs course name — contains a Dockerfile where the training task is replaced with a single os.system() call to the cryptomining binary. The container is pushed to Google Container Registry and executed via Vertex AI jobs or GCP AI Platform training jobs.

Abuse extends to exotic AWS services. Hernandez discovered miners running inside AWS HealthOmics (genomics workflow service) by modifying workflow definition files to inject mining commands directly into task definitions. The workflow loops, mining until the temporary account expires. Similarly, SageMaker endpoints and studio apps are being used, with actors storing account credentials (username, password, timestamp) in plaintext files.

A complete underground marketplace. Telegram channels host an active marketplace for:

• Selling created GitHub accounts and Student Developer Pack accounts
• Selling RDP/VPS access from compromised free-tier accounts
• Training courses on cryptomining techniques (basic free, premium paid)
• Advanced evasion techniques including process hiding and cloud agent detection/killing

Indonesian origins. A significant portion of the text, comments, and messages are in Indonesian (including slang), suggesting the operation's base. Given relative purchasing power, even modest cryptomining profits may be economically viable.

Technical Deep Dive

▶ Watch: AWS HealthOmics genomics service abused for cryptomining by modifying workflo... (10:00)

The technical operation follows a consistent pattern regardless of target platform:

1. Account creation: iMacros automates Microsoft account registration → GitHub account creation → enrollment in educational platforms (Coursera, Qwiklabs).
2. Credit acquisition: Stolen Canvas IDs upgrade accounts to Student Developer Pack status for additional cloud credits.
3. Infrastructure provisioning: Temporary GCP projects are created through lab platforms; AWS accounts are provisioned through free-tier offerings.
4. Payload deployment: Cryptomining binaries are packaged in Docker containers disguised as ML training jobs. The template is always the same — a legitimate lab Dockerfile with the training command replaced by os.system() calling the miner.
5. Evasion: Standard techniques include LD_PRELOAD for library injection, process hiders, and scripts that identify and kill cloud monitoring agents by PID. The obfuscation is not sophisticated — actors rely on the temporary nature of accounts rather than advanced stealth.
6. Profit extraction: Temporary wallets are used, with profits moved quickly to larger wallets. Hernandez observed wallets with thousands of euros but could not confirm final profit figures due to the transient wallet strategy.

The actors maintain separate operational cells: account creators sell to miners who sell to RDP/VPS resellers. Cloud provider detection agents (monitoring agents) are targeted with simple PID-based kill scripts — not sophisticated, but sufficient to maintain temporary accounts long enough to mine profitably.

Notably, the actors themselves communicate about which platforms are still viable. Hernandez observed messages advising against running miners on IBM Cloud and Oracle Cloud because "it doesn't work anymore" — suggesting active tracking of platform defenses.

Demo / Proof of Concept

▶ Watch: Contacting the actors directly — one responds offering Telegram contact (12:00)

Hernandez did not perform a live demonstration but showed screenshots and code from active repositories, including iMacros automation scripts, Dockerfile templates with injected mining commands, plaintext credential stores, and Telegram marketplace listings. Many of the repositories remain active on GitHub and are findable through GitHub's search engine.

Defensive Implications

▶ Watch: Valid credit card stored in plaintext in a repo — used for Coursera enrollmen... (16:00)

For cloud providers: The free-tier abuse model exploits the gap between account creation and abuse detection. Temporary accounts running for 1-2 hours generate mining revenue before being terminated. Detection of cloud agent kill scripts and identification of mining binaries within containerized ML training jobs should be prioritized.

For educational platform providers (Coursera, Qwiklabs/Cloud Skills Boost): The intermediary abuse model — where educational platforms serve as a hop to cloud resources — represents a blind spot. Stolen student identity verification and credit card reuse patterns could be detection signals.

For enterprises: This research is primarily relevant to cloud providers rather than enterprise defenders. Hernandez explicitly noted he did not observe these groups attacking real customer accounts — the operation is focused entirely on free-tier and temporary account abuse. The closest enterprise concern is RDP/VPS reselling, where temporary cloud instances may be used as attack infrastructure.

Key Takeaways

• Cloud free-tier abuse is an organized, semi-professionalized industry with distinct operational cells for account creation, mining, and resale.
• Actors route through educational platforms (Coursera, Qwiklabs) as intermediaries to access GCP and AWS resources, rather than registering directly with cloud providers.
• Stolen Canvas student IDs are used to upgrade GitHub accounts to Student Developer Pack status, unlocking premium cloud credits.
• Cryptomining payloads are hidden inside Docker containers disguised as ML training jobs, running on Vertex AI, SageMaker, and even AWS HealthOmics.
• A Telegram-based marketplace sells accounts, RDP access, and paid training courses on free-tier abuse techniques.
• The evasion techniques are not sophisticated — actors rely on account volume and temporary duration rather than advanced stealth.

About the Speaker(s)

Miguel Hernandez is a Senior Threat Research Engineer at Sysdig, based in Spain, with over 10 years of security research experience across multiple security companies. He collaborates on open-source projects and contributes to Spanish-language technology news communities. This research represents approximately 18 months of tracking and investigating the free-tier abuse ecosystem.