What Is Cryptojacking? Hidden Cryptocurrency Mining Threats

The Silent Theft of Computing Power

Cryptojacking is a form of cybercrime in which attackers secretly use victims' computing resources to mine cryptocurrency without their knowledge or consent. Unlike ransomware, which announces its presence immediately, cryptojacking operates silently in the background — the only symptoms may be a slower device, higher electricity bills, and reduced hardware lifespan. By 2023, cryptojacking attacks had increased over 300% compared to the previous year, making it one of the fastest-growing cyber threats.

The economics are straightforward: cryptocurrency mining requires significant computational power and electricity. By distributing the workload across thousands of compromised devices, attackers avoid infrastructure costs while generating passive income from mined coins.

How Cryptojacking Works

Infection Methods

• Malicious scripts in websites — JavaScript miners embedded in compromised or malicious web pages run in visitors' browsers (browser-based mining)
• Malware installation — Trojanized software, phishing emails, or exploit kits install persistent mining software on endpoints
• Cloud infrastructure compromise — Attackers gain access to cloud accounts (AWS, Azure, GCP) and spin up mining instances using the victim's billing
• Supply chain attacks — Mining code injected into legitimate software packages or Docker images
• Insider threats — Employees using corporate infrastructure for personal mining operations

Mining Process

Once active, the mining software connects to a mining pool, receives computational tasks (typically Monero's RandomX algorithm, chosen for its CPU-friendly design and privacy features), solves proof-of-work puzzles, and submits solutions for cryptocurrency rewards directed to the attacker's wallet.

Types of Cryptojacking

Notable Cryptojacking Campaigns

Detection Methods

• CPU monitoring — Sustained high CPU usage (80–100%) during idle periods indicates mining activity
• Network analysis — Connections to known mining pools (port 3333, 45700) or Stratum protocol traffic
• Endpoint detection and response (EDR) — Behavioral analysis identifies mining process patterns
• Browser extensions — Tools like No Coin or minerBlock detect and block JavaScript miners
• Cloud billing alerts — Unusual compute cost spikes may indicate compromised instances

Prevention and Protection

• Keep software and systems patched to prevent exploitation of known vulnerabilities
• Deploy ad-blockers and anti-mining browser extensions for end users
• Implement network monitoring and DNS filtering to block mining pool connections
• Use cloud security posture management (CSPM) to detect unauthorized instances
• Monitor container registries and validate image integrity before deployment
• Educate employees about phishing and suspicious downloads

Cryptojacking vs. Other Threats

Unlike ransomware, which causes immediate disruption, cryptojacking's damage is gradual — shortened hardware life, increased energy costs, degraded performance, and potential security implications of the initial compromise vector. Organizations often discover cryptojacking only after months of operation, by which time the attacker has already profited significantly while the victim bears the infrastructure costs.

As cryptocurrency values fluctuate and mining difficulty increases, cryptojacking remains attractive to cybercriminals because it requires minimal interaction with victims, generates passive income, and carries lower legal risk than more aggressive attack types like ransomware or data theft.