Akamai researchers uncovered a Tor-based cryptojacking campaign in August 2025, exploiting misconfigured Docker APIs to hijack cloud resources for Monero mining. This attack masks activities via anonymous routing and may evolve into botnets for DDoS or data theft. Organizations must audit configurations and monitor Tor traffic to mitigate risks.