Cryptojacking is the unauthorised use of someone else’s computing resources to mine cryptocurrency. The victim may be a person whose browser or laptop is abused, a company with compromised cloud credentials, or an organisation whose servers are infected through a vulnerable application.
The immediate loss is often electricity and cloud capacity rather than stolen coins. The wider damage can include degraded services, overheated hardware, unexpected bills and evidence that an attacker has obtained access that could be used for more destructive activity.
How hidden mining reaches a device
Early browser-mining campaigns embedded scripts that consumed a visitor’s CPU while a page remained open. Modern incidents are frequently server-side. Attackers scan for exposed services, exploit unpatched software, steal cloud keys, abuse containers or install a miner after phishing an administrator. Compromised software packages and deployment pipelines can distribute mining code across many systems at once.
A miner is not necessarily malicious software in isolation. The abuse lies in running it without informed authorisation, concealing its resource use or obtaining access through intrusion. A site that clearly asks users to opt in is different from code that starts automatically behind an unrelated page.
Warning signs
- CPU or GPU use stays high when expected applications are idle.
- Fans run constantly, devices become unusually hot or battery life drops sharply.
- Cloud-compute spending rises without a corresponding workload.
- New scheduled tasks, services, containers or startup entries appear.
- Systems make repeated connections to unfamiliar mining-pool domains or ports.
- Performance problems return after a process is terminated, suggesting persistence.
None of these proves cryptojacking by itself. Video rendering, software compilation and legitimate analytics can produce similar symptoms. Investigation should correlate process names, parent processes, executable hashes, network destinations, account activity and the time the resource spike began.
Prevention for individuals
Install operating-system, browser and application updates promptly. Use a reputable security product, remove extensions that are no longer needed and grant each extension the narrowest possible permissions. Treat unexpected documents, installers and browser prompts as potential entry points. An ad blocker or DNS filter may stop known mining domains, but it cannot replace patching or protect a compromised account.
If a device suddenly slows down, check the operating system’s process monitor before installing a random “cleaner.” Disconnect from sensitive accounts, preserve useful evidence and run an offline or trusted security scan. Change credentials from a known-clean device if account compromise is possible.
Controls for companies and cloud teams
- Inventory internet-facing services and remove default credentials.
- Use multi-factor authentication and short-lived cloud credentials.
- Apply least privilege to workloads, service accounts and container runtimes.
- Set billing alerts and resource quotas at account and project level.
- Monitor new compute instances, unusual regions and sustained CPU utilisation.
- Restrict outbound traffic so workloads cannot freely contact mining pools.
- Scan images and dependencies before deployment and protect the build pipeline.
The OWASP API Security project is useful when the intrusion begins through exposed application interfaces, while general account and phishing controls remain essential. Crypto-specific blocking alone can miss an attacker who changes pools or proxies traffic.
Respond to the intrusion, not only the miner
As with the broader risks in our crypto-asset security checklist, killing the mining process treats only a symptom. Rotate exposed credentials, close the initial access path, review logs for lateral movement and rebuild affected systems from a trusted image when integrity is uncertain. Check whether data was accessed or exfiltrated. A quiet miner may have been selected because it earns money without drawing the attention that ransomware would attract.
Cryptojacking is best understood as unauthorised resource theft and a security incident. Its connection to cryptocurrency describes the attacker’s workload, not the full extent of the compromise.
