Nova didn’t let go of his hand for a full five seconds. She just stood there, gripping his fingers like she was testing whether he’d flinch.
Pax didn’t flinch. He was too confused to flinch.
“Nova,” he repeated, pulling his hand back. “Just Nova?”
“Just Nova.” She walked past him to the teacher’s station, sat down without asking, and started typing. Her fingers moved across the keyboard faster than Pax’s—and he’d thought he was fast. “I don’t do last names online. Keeps people from finding my mom.”
“Finding her for what?”
Nova didn’t answer. She had already pulled up a command prompt and was running network diagnostics on the lab’s switch. Pax watched over her shoulder as lines of text scrolled past—pings, traceroutes, ARP tables.
“You know your way around a network,” he said. It wasn’t a compliment. It was an assessment.
“I know my way around your network.” She didn’t look up. “The command-and-control server for this cryptojacking operation resolves to an IP address in this building’s range. You want to explain that?”
“I already told you. I didn’t do this.”
“People who didn’t do this don’t usually have their name on the malware’s domain registration.” She swiveled the monitor toward him. On the screen was a WHOIS lookup for c2.paxs-cooling-script.xyz. The registrant name was listed as “Pax Chen.” The email was pax.chen@[his school's domain].org.
“That’s fake,” Pax said. “Anyone can put any name in a WHOIS record. Most registrars don’t verify.”
Nova’s eyes narrowed. “Convenient.”
“Truthful.” He pulled up a chair next to her, close enough that their shoulders almost touched. He didn’t like being this close to a stranger, but he needed to see what she was seeing. “Look at the creation date on that domain. It’s 75 days ago. Three weeks before the first infected machine showed up in my logs. If I were running this operation, why would I register a domain with my own name and then wait three weeks to use it?”
Nova was quiet for a moment. Then she said, “To throw off suspicion. Make it look like a frame job.”
“That’s paranoid.”
“This is cryptojacking.” She finally looked at him. Her eyes were dark brown, almost black, and there were shadows underneath them—the kind you get from not sleeping. “Paranoid is the baseline.”
Scene 2: Nova’s Backstory
Pax leaned back in his chair, rubbing his eyes. He’d been awake for most of the night, and the adrenaline crash was starting to hit. But Nova showed no signs of fatigue. She was like a machine—focused, relentless, cold.
“How do you know so much about this?” he asked. “Cryptojacking, I mean. You’re not in my district. You don’t go here. So how did you find me?”
Nova’s fingers paused on the keyboard. For a second, something flickered across her face—pain, maybe, or anger. Then it was gone.
“My mom is a nurse at County General,” she said. “ICU. Night shift.”
Pax felt his stomach tighten. County General was the hospital on his dashboard. The one with the infected ventilator.
“Three weeks ago,” Nova continued, her voice flat, “she was working a code blue. Patient in cardiac arrest. They had him on the monitor, the ventilator, the whole setup. And in the middle of the code, the monitor froze. Just—froze. Flatlined on the screen while the patient’s heart was still beating.”
“Jesus.”
“The ventilator kept working, thank God. But the monitor was down for forty-seven seconds. They had to check his pulse manually, coordinate breaths without the display.” She finally stopped typing. Her hands rested motionless on the keyboard. “He lived. But my mom said—she said it felt like forever. Like the machines had just given up.”
Pax didn’t know what to say. I’m sorry felt too small. It wasn’t my fault felt like a lie.
“The IT guys found the cause,” Nova went on. “CPU overload. Some hidden process was eating all the processing power. They cleaned it, rebooted, and it came back the next day. And the next. And the next.”
“That’s when you started investigating.”
“That’s when I started hunting.” She turned to face him fully. “I’ve been tracking cryptojacking malware for eight months. I’ve found it on school computers, library terminals, even a smart fridge at someone’s house. But hospital equipment? That was new. That was personal.”
She pulled up a folder on her laptop—because of course she had her own laptop, a ruggedized thing covered in stickers from security conferences. The folder was labeled PUPPETEER.
“The Puppeteer,” Pax read. “That’s what you call them?”
“That’s what they call themselves. It’s a handle on a few darknet forums. They’ve been bragging about their botnet for over a year. Hundreds of thousands of devices. Millions of dollars in Monero.” She opened a file—a screenshot of a forum post. The username was Puppeteer and the message read: “My puppets dance whether they know it or not. That’s the beauty of strings.”
“And you think I’m the Puppeteer?”
Nova pulled up another file. This one was a code comparison—his original system_optimizer_v1.py on the left, and the malware’s system_optimizer_v2.exe on the right. The similarities were obvious. Variable names, function structures, even the comments. Whoever had written the malware had started with Pax’s code and built on top of it.
“Your script is the core,” Nova said. “The mining payload is standard—open source Monero miner, lightly modified. But the propagation mechanism, the persistence, the geofencing—that’s custom. And it all routes through a C2 server registered to your name, hosted on your school’s IP range.”
She closed the laptop and stood up. “So either you’re the Puppeteer, and you’re the dumbest criminal in the world for leaving evidence everywhere, or someone is using you as a cover. Which is it?”
Pax stood up too. They were almost the same height. “Someone framed me. And I can prove it.”
“How?”
“Let me show you my machine. Clean it. Watch me do it.”
Nova’s eyes searched his face for a long moment. Then she gave a single nod. “Fine. But not here. Somewhere with no network.”
Scene 3: The Reluctant Truce
They ended up at Pax’s house, which was a twenty-minute walk from the school through a neighborhood of modest ranches and dying lawns. Nova walked half a step behind him the whole way, her eyes scanning streets, driveways, parked cars. Checking for tails, Pax realized. She really was paranoid.
His house was quiet when they arrived. His mom worked nights at a call center, which meant she’d be asleep in her bedroom until at least 2 PM. Pax led Nova past the living room—covered in unfolded laundry—and down to the basement.
The basement was his real bedroom. He’d moved down there two years ago because it was cooler in the summer and because he needed space for his projects. A long workbench ran along one wall, covered in circuit boards, soldering equipment, and three dead hard drives he was trying to recover data from. His desktop computer sat in the corner—a custom build with a glass side panel and RGB fans that he’d set to a soothing blue.
“Nice setup,” Nova said, and for the first time, she sounded like she meant it.
“It’s a mess.”
“It’s an organized mess. There’s a difference.”
Pax sat down at his desktop and gestured to the chair next to him. Nova hesitated, then sat. She pulled a USB drive from her pocket—bright red, with a skull sticker on it—and plugged it into his front panel.
“This is my diagnostic toolkit,” she said. “It’ll find any miner on your system, even the ones that hide in firmware. But I need you to agree to let me run it. No complaints about privacy.”
“Run it.”
She launched a custom executable from the drive. A black window opened, filled with scrolling text. Pax watched over her shoulder as the tool enumerated every process, every service, every hidden registry key. It took less than two minutes.
“Found it,” Nova said. “Same variant. xmr-stak-rx.exe disguised as svchost.exe in a fake system32 folder.” She paused, frowning. “But look at the C2 address.”
Pax leaned in. The malware was configured to phone home to c2.paxs-cooling-script.xyz—the same domain from the lab. But there was a second address, a backup: backup.puppeteer.bot.
“Your name and their handle,” Nova murmured. “They’re not just framing you. They’re mocking you.”
“Or they’re lazy,” Pax said. “The backup domain is registered anonymously. The main domain uses my name. That’s not a frame job—that’s a trap. They want someone to trace it to me.”
Nova was quiet for a long moment. Then she unplugged her USB drive and leaned back in her chair. “Okay,” she said. “Maybe you’re not the Puppeteer.”
“Maybe?”
“You’re still responsible. Your code, your negligence, your lack of security.” She held up a hand before he could argue. “I’m not saying you meant for this to happen. But you wrote a script that could be weaponized, and you didn’t put any safeguards in it. No encryption. No signature verification. No kill switch. That’s on you.”
Pax wanted to argue. But she was right. He’d been so focused on helping his school that he hadn’t thought about who else might use his work. He’d trusted that other people would be as ethical as he was.
That had been stupid.
“Fine,” he said. “So what do we do now?”
“Now we work together.” Nova pulled out her phone and opened a mapping app. “Your school’s network is patient zero. The first infected machines showed up there three weeks ago. Which means someone inside your school deployed the initial payload.”
“I already thought of that.” Pax told her about Marcus—the AV club president, the basement mining rig, the new used car. “He had access to my admin password. He watched me type it.”
“Marcus is a pawn,” Nova said immediately. “Script kiddies don’t build botnets. They buy access to them. We need to find out who’s supplying him.”
“How?”
Nova smiled. It was not a friendly smile. “We ask him nicely.”
Scene 4: The Investigation Begins
They found Marcus in the parking lot of the school, sitting in his new-used Honda Civic, vaping through the cracked window. It was lunch period, and most of the student body was either in the cafeteria or loitering near the gym. Marcus had chosen the far corner of the lot, where the teachers never patrolled.
Pax knocked on the driver’s side window. Marcus jumped so hard he dropped his vape pen.
“Dude!” Marcus rolled down the window, his face pale. “You scared the—” He saw Nova standing behind Pax and stopped. “Who’s that?”
“Someone who wants to ask you some questions,” Pax said. “About the mining software on the lab computers.”
Marcus’s face went from pale to gray. “I don’t know what you’re talking about.”
“Marcus.” Pax kept his voice calm, even friendly. “I pulled the logs. The first infected machine was the AV club streaming server. You’re the only person in the AV club who knows how to install software on that thing.”
“That doesn’t mean—”
“The domain registration traces back to this school’s IP range. The malware uses my cooling script. And you,” Pax said, leaning on the car door, “watched me type my admin password three months ago. You want to keep lying, or do you want to start talking?”
Marcus’s hands were shaking on the steering wheel. Nova stepped closer, her presence somehow more intimidating than Pax’s questions.
“I didn’t know what it would do,” Marcus whispered. “He said it was just idle cycles. He said no one would notice.”
“Who?” Pax demanded.
“I don’t know his real name. He goes by Puppeteer on the forum. He pays in Monero—I never see his face, never hear his voice. Just messages.”
“What did he ask you to do?”
Marcus swallowed hard. “He sent me a package. An installer. Said to run it on a ‘trusted network’—somewhere with good uptime and weak security. He wanted to test the geofencing before rolling it out to the whole botnet.”
“You tested it on your own school?”
“It was just supposed to run after hours! When no one was using the computers!” Marcus’s voice cracked. “I didn’t know it would spread. I didn’t know about the hospitals. I swear.”
Nova’s eyes were like flint. “How much did he pay you?”
“…Half a Monero. It was like a hundred dollars at the time.”
“A hundred dollars to infect your school.” Nova’s voice was quiet, but there was steel underneath. “My mom’s hospital was on that list, Marcus. Did you know that?”
Marcus shook his head frantically. “No! He didn’t tell me where else it would go. Just said to run the installer and leave the computer on overnight.”
Pax believed him. Marcus was a lot of things—cocky, careless, greedy—but he wasn’t a monster. He was just a kid who’d made a stupid decision for quick money.
But that didn’t change the damage.
“You’re going to help us,” Pax said. “You’re going to give us everything—the forum username, the messages, the wallet address where he sent the payment. And then you’re going to tell the principal what you did.”
Marcus’s eyes went wide. “I can’t. He’ll—I don’t know what he’ll do. The Puppeteer, he’s—”
“He’s a thief,” Nova interrupted. “And right now, he’s using you as cover. The longer you protect him, the more computers get infected. Including, maybe, the ones that keep people alive.”
Marcus stared at her. Then at Pax. Then down at his hands.
“Okay,” he whispered. “Okay. I’ll help.”
Scene 5: The Mole
They spent the next hour in the school library, going through Marcus’s forum account. The Puppeteer’s messages were carefully written—no slang, no typos, nothing that could identify them. But Marcus had saved the transaction ID for the Monero payment, and Nova had tools that could trace blockchain transactions.
“Monero is privacy-focused,” she explained to Pax as they worked. “The transactions are obfuscated by default. But if you have the view key—which we don’t—or if the sender makes a mistake, you can sometimes follow the trail.”
“Did the Puppeteer make a mistake?”
Nova pointed at the transaction log. “He used a mixing service to anonymize the coins. But this mixing service has a known vulnerability—it leaks timing information. I can narrow down the origin wallet to a specific pool of about fifty addresses.”
“Fifty addresses is a lot.”
“Fifty is better than fifty thousand.” She copied the data to her laptop. “I’ll run it through my analysis tools tonight. By tomorrow, I might have a location.”
Pax leaned back in his library chair, exhausted. The fluorescent lights hummed overhead. Through the windows, he could see students walking to class, laughing, completely unaware that thousands of computers were mining crypto in the background.
“One thing I don’t understand,” he said. “The malware has a geofence, right? It doesn’t mine during school hours on the lab computers. But my laptop was mining at 3 AM. So the geofence is keyed to specific devices.”
“Or specific times,” Nova said. “The lab computers have a known schedule—school hours, weekends off. The Puppeteer programmed the malware to respect that schedule to avoid detection.”
“But my laptop doesn’t have a schedule. I take it everywhere. So why would it mine at 3 AM?”
Nova frowned. She pulled up the malware’s configuration file and scrolled through the settings. “Look at this,” she said, pointing to a line of code.
<geofence type="battery"> <threshold>20</threshold> <action>pause</action> </geofence>
“The malware pauses mining when the battery is below 20 percent. That’s why it was mining at 3 AM—your laptop was plugged in. But on lab computers, the geofence is set to time-of-day.”
“That’s… considerate,” Pax said, surprised.
“Not considerate. Strategic.” Nova’s eyes narrowed. “The Puppeteer wants the malware to stay hidden. If laptops started dying in the middle of the school day, people would notice. So they only mine when the device is plugged in and idle.”
“That’s smart.”
“It’s evil. But it’s smart.” Nova closed her laptop. “We need to find the Puppeteer before they expand the botnet. Marcus said they were planning a ‘second wave’—something bigger than school computers.”
Pax thought about the ventilator on his dashboard. The hospital equipment. The traffic light controllers that Marcus had mentioned in passing.
“The Puppeteer isn’t just mining Monero,” Pax said slowly. “They’re building a weapon. A botnet that can reach into critical infrastructure. And they used my school as a testing ground.”
Nova met his eyes. “Which means they’re close. They wouldn’t test somewhere far away. The Puppeteer is local.”
The library doors opened. A teacher walked in, saw them, and told them to get to class. Pax and Nova packed up their things and walked out into the hallway.
“We’re going to find them,” Nova said. It wasn’t a question.
“We’re going to stop them,” Pax corrected. “Finding is just the first step.”
He checked his phone. A new message from the unknown number—the same one that had texted him that morning.
“Nice try with Marcus. He doesn’t know anything. But you’re getting closer. Keep looking. I like the chase.”
Pax showed Nova the message. She read it, her jaw tightening.
“He’s watching us,” she said.
“He wants us to watch him.” Pax typed a reply: “We’re not playing your game.”
The response came immediately: “You don’t have a choice. The game is already playing you.”
Nova grabbed Pax’s phone and turned it off. “No more responses. He’s trying to bait you.”
“Or distract us.”
“Same thing.” She handed the phone back. “We need to work faster. Tomorrow, I’ll have that location. In the meantime, don’t trust anyone at your school. The Puppeteer could be anyone—teacher, student, janitor.”
Pax nodded. The warning felt heavy, like a weight on his chest.
He’d come to school that morning thinking he could fix anything with enough code and coffee. Now he knew the truth: some problems couldn’t be solved with a script. Some problems required trust, and trust was the one thing he couldn’t afford to give.
As Nova walked away toward the front doors, Pax watched her go. She was a stranger, a rival, an accuser. But she was also the only person in the world who believed he wasn’t the bad guy.
For now, that would have to be enough.
Table of contents:
Introduction
Chapter 1: The Silent Miner
Chapter 2: A Thief in the Circuitry
Chapter 3: The Hashrate Hijack <<<<<< NEXT
Chapter 4: A Conscience in the Kernel
Chapter 5: The Botnet’s Lullaby
Chapter 6: Proof-of-Work, Proof-of-Harm
Chapter 7: The Green Mine Proposal
Chapter 8: Rewriting the Unwritten
Chapter 9: The Ethical Fork
Chapter 10: A Clean Block
