A profit-driven threat actor has been noted taking advantage of a recently revealed remote code execution vulnerability impacting the Craft Content Management System (CMS) to implement various payloads, such as a cryptocurrency miner, a loader known as Mimo Loader, and residential proxyware. The vulnerability in discussion is CVE-2025-32432, a critical severity issue in Craft CMS that was addressed in