According to a report from IT Home, the network security company Dr. Web issued a document stating that an attacker has recently discovered that an attacker has distributed Win10 ISO images and hidden mining codes in the EFI (Extensible Firmware Interface) partition, which can avoid the detection of anti-virus software. Once the device is infected, it will monitor the process explorer, task manager, process monitor, process, etc. Once the cryptocurrency wallet address in the clipboard is found, it will be immediately replaced with the address preset by the attacker. Dr. Web said investigation of the redirected crypto wallet address found at least $19,000 worth of cryptocurrency in the address.