Threat actors part of the proxyjacking campaign exploited Selenium Grid servers' "goog:chromeOptions" configuration to facilitate deployment of a base64-encoded Python script, which enabled the retrieval of an open-source GSocket reverse shell.
Article Link: Proxyjacking, cryptomining against Selenium Grid servers escalate | SC Media