What Is Cryptojacking?
Cryptojacking hijacks your computing resources to mine cryptocurrency for attackers.
How Cryptojacking Works
Browser-based cryptojacking uses JavaScript embedded in compromised websites or delivered through ad networks to run cryptomining code in visitors' browsers. The mining code executes for as long as the browser tab is open, using the visitor's CPU. This technique peaked around 2017-2019 with the Coinhive JavaScript miner before the service closed.
Host-based cryptojacking installs cryptomining software on compromised servers, workstations, and cloud instances. Attackers gain initial access through phishing, vulnerability exploitation, or credential theft, then deploy cryptomining software that runs as a background process. The mining software competes for CPU resources with legitimate workloads, causing performance degradation that is often the first symptom detected.
Cloud cryptojacking targets misconfigured cloud environments — exposed Kubernetes clusters, misconfigured container registries, AWS instances with weak credentials — to deploy high-CPU cloud instances that mine cryptocurrency at the victim's expense. Cloud cryptojacking bills have reached hundreds of thousands of dollars before detection in documented cases.
Detection and Defense
Cryptojacking detection focuses on performance anomalies and unauthorized process execution. Unexpected CPU and GPU utilization spikes on servers and workstations indicate potential cryptomining activity. Cloud cost anomaly monitoring detects unexpected compute spend that indicates unauthorized cloud resource provisioning. Endpoint detection with process behavioral analysis identifies cryptomining software regardless of the specific binary, because cryptomining behavior — sustained high CPU utilization by a process with specific network communication patterns — is distinctive.
Cloud Cryptojacking Prevention
Cloud security posture management continuously monitors cloud environments for the misconfigurations that cryptojacking attackers exploit: publicly accessible Kubernetes API servers, unauthenticated Docker registries, overly permissive IAM roles that allow new compute instance creation. Cloud cost monitoring with anomaly alerting provides early warning of cryptomining operations before costs accumulate significantly. AWS, Azure, and GCP all provide native cost anomaly detection services that alert on spending patterns inconsistent with historical baselines.
Related Reading
What is cryptojacking?
Cryptojacking is the unauthorized use of someone else's computing resources to mine cryptocurrency for the attacker. Cryptojacking malware infects systems and uses their CPU and GPU resources to perform the mathematical calculations that generate cryptocurrency, sending the mined currency to attacker-controlled wallets. The victim pays for the electricity, hardware wear, performance degradation, and cloud compute costs while the attacker keeps the profit.
How does cryptojacking work?
Cryptojackers infect target systems through standard malware delivery vectors: phishing email attachments, exploited vulnerabilities, drive-by downloads, and supply chain compromise. The malware then runs cryptocurrency mining software (typically targeting Monero because Monero is profitable on consumer-grade CPUs) in the background, consuming CPU cycles. Some cryptojackers operate as browser-based JavaScript that mines while the user has a compromised website open — mining stops when the browser tab closes.
What is the difference between cryptojacking and cryptomining?
Cryptomining is the legitimate process of dedicating computing resources to generate cryptocurrency. Cryptojacking is unauthorized cryptomining — using someone else's resources without consent. The technology and code are similar; the distinction is whether the resource owner authorized the activity. A datacenter operator running mining on their own hardware is mining; the same code running on a compromised cloud instance is cryptojacking.
How does cryptojacking damage organizations?
Cryptojacking does not steal data or directly disrupt operations, which historically caused it to be deprioritized as a security concern. The actual damages are significant. CPU consumption degrades application performance and increases response times. Hardware wear accelerates from sustained high CPU utilization. Power consumption increases costs. Cloud compute resource consumption produces unexpected bills — cryptojacking in cloud environments can produce tens or hundreds of thousands of dollars in compute charges before detection. And critically, cryptojacking presence indicates the system has been compromised, which means other attacks are also possible from the same access vector.
How is cryptojacking detected?
The primary signal is unexpected sustained high CPU or GPU utilization. Performance monitoring that establishes baselines for normal resource consumption can identify deviation patterns characteristic of cryptojacking. EDR platforms detect cryptocurrency mining software through behavioral and signature-based detection. Network monitoring identifies communication with known cryptocurrency mining pools. Cloud cost monitoring catches unexplained compute consumption increases that often indicate cloud cryptojacking. Browser-based cryptojacking is detected by browser extensions that block cryptocurrency mining scripts.
What is the largest cryptojacking incident?
The 2018 Tesla incident was one of the first publicized cloud cryptojacking cases — attackers compromised a misconfigured Kubernetes administration console and deployed cryptomining containers using Tesla's AWS credentials. RedLock detected the activity through cloud activity monitoring. The 2019 attack on Docker Hub that compromised over 5 million accounts included cryptomining payloads. More recent campaigns have targeted GitHub Actions runners, exploiting CI/CD compute resources to mine cryptocurrency in the background of legitimate developer workflows.
How do organizations defend against cryptojacking?
EDR with behavioral detection is the primary endpoint control. Performance baselines and anomaly detection identify CPU consumption patterns characteristic of mining. Cloud workload protection platforms (Microsoft Defender for Cloud, AWS GuardDuty, Wiz, Lacework) monitor for cryptojacking in cloud environments. Browser extensions like MinerBlock and NoCoin block browser-based cryptojacking. Network DNS filtering blocks communication with known cryptocurrency mining pools. Patch management closes the unpatched vulnerabilities that cryptojackers exploit for initial access. The same defense-in-depth that addresses other malware addresses cryptojacking.
Real-World Example: Tesla's AWS Environment Cryptojacked
In 2018, security researchers discovered that Tesla's AWS environment had been compromised and was being used for cryptomining. The attackers gained access through an unsecured Kubernetes administration console that had no password protection. From the Kubernetes console, they accessed AWS credentials and deployed cryptomining workloads. Tesla's own cloud environment was mining cryptocurrency for attackers at Tesla's expense. The incident highlighted that cryptojacking is not limited to consumer devices or small organizations — cloud misconfigurations in sophisticated engineering organizations create the same exploitation opportunities.
In stolen compute resources through cryptojacking in 2023 — making it one of the most financially significant cybercrime categories by value transferred, even though individual victims often experience it as performance degradation rather than obvious theft.