Hackers Hijack Plex Servers to Mine Crypto After Oct. 16 Leak

A publicly released exploit on October 16 has triggered a wave of automated attacks against self-hosted media servers, turning personal home entertainment hardware into cryptocurrency mining rigs and unauthorized internet proxies. The assault targets users running older versions of the Plex Media Server software.

The breach relies on a chain of vulnerabilities that allows an unauthenticated remote attacker to execute code with the exact privileges of the server process, according to Plex. Attackers are not attempting to steal movies or music libraries. Instead, compromised machines are being forced to run illicit cryptocurrency miners and proxy software designed to route third-party traffic through the victim’s residential internet connection.

Plex warned that any server running a version older than 1.43.3.10861 and exposed to the public internet should be treated as potentially compromised. The company noted it has observed widespread attacks since the proof-of-concept code surfaced last week.

This incident highlights the hidden risks of the self-hosted media movement. Platforms like Plex allow users to install server software on Windows, macOS, Linux machines, or network-attached storage devices from manufacturers such as QNAP, Synology, and Netgear, transforming local hardware into a private streaming service accessible from smartphones, smart TVs, and gaming consoles. To enable viewing outside the home network, users frequently open port 32400 to the wider internet. That convenience creates a direct attack surface when underlying software flaws go unpatched.

Self-hosting enthusiasts often assume their obscure home setups fly under the radar of professional cybercriminals. The speed of exploitation following the October 16 disclosure proves otherwise. Automated scanning tools routinely sweep the internet for open ports associated with popular media server applications, meaning vulnerable systems are typically identified and targeted within hours of a new exploit becoming public.

Server owners checking their systems for signs of intrusion should look for unfamiliar processes spawned by the media server application, specifically those named “myawesomeproxy,” “mylovelyminer,” or “x12345,” according to Plex. Other indicators include unknown .so or .dll files appearing in the Codecs directory, sustained high CPU usage while no media is playing, or unexpected outbound connections to domains such as proxystream.st.

Users who identify these artifacts or cannot definitively rule out tampering face a difficult recovery process. Plex advises rebuilding the server entirely from a clean installation rather than reusing the existing data directory. At minimum, administrators must delete all contents within the Codecs folder and manually inspect the Preferences.xml file for unauthorized transcoder configurations.

Because the exploited vulnerability grants attackers the same system privileges as the media server itself, the fallout extends beyond the application. Any mounted network shares, stored credentials, or other services running on the same machine or virtual environment could be fully exposed. Plex recommends immediately signing out of all connected devices via account settings and changing the account password.

The current stable releases sit at Plex Server version 1.43.5.11029, Plex Player version 1.115.0.426, and the Android client at version 10.17.0.868. For operators who do not require access to their media libraries while away from home, disabling remote access entirely in the general settings remains the most effective way to eliminate this specific threat vector.