Cryptojacking

Cryptojacking is the unauthorized use of someone else's computing resources to mine cryptocurrency. The attacker pockets the coins; the victim pays the bill — in electricity, cloud compute charges, degraded performance, and shortened hardware life. Because the payload is designed to stay quiet and steal cycles rather than data, cryptojacking often runs for months before anyone asks why the fans never stop or why the cloud invoice doubled.

How it works

Delivery uses the standard malware channels. Phishing attachments and trojanized downloads install persistent miners on endpoints and servers; compromised websites and malicious ads have historically run browser-based miners that hijack visitors' CPUs for as long as the tab stays open — a scheme that exploded during the 2017–2019 Coinhive era and still resurfaces. Botnets deploy miners across thousands of infected machines as one revenue stream among several, and some adware bundles quietly include mining components.

The enterprise-grade variant targets the cloud. Attackers who obtain credentials — through phishing, leaked keys in public repositories, or infostealer logs — spin up fleets of high-powered compute instances in the victim's account and mine at industrial scale. Container platforms and misconfigured Kubernetes clusters are favorite real estate. Here the damage is not slowness but money: a single compromised cloud account can burn tens of thousands of dollars of compute in days, and the same access that mines coins today can deliver ransomware tomorrow.

How to defend against it

Prevention overlaps with anti-malware basics: patching, application control, DNS filtering that blocks known mining pools, and browser protections against malicious scripts. Detection is where cryptojacking differs — watch for sustained unexplained CPU and GPU usage, overheating endpoints, and cloud billing anomalies, and alert on them the way you would on data exfiltration. Guard the credential layer hard: MFA on cloud consoles, no long-lived keys in code, and rapid rotation when an infostealer infection is found. And since the initial foothold is usually a human decision — a fake installer, a phishing link, a malicious ad — the same training and simulation program that blunts phishing shrinks the mining problem with it.