Crypto-mining worm steal AWS credentials