What Is a Cryptojacker? Unauthorized Mining Malware

Most malware wants your data or your money directly. A cryptojacker wants something quieter: your electricity, your processor cycles, and your cloud bill. It quietly turns your device into a mining rig for cryptocurrency the attacker keeps, and its whole strategy is to stay hidden long enough to keep earning. You pay the power and the wear; someone else collects the coins.

A cryptojacker is malware that hijacks a device's computing resources to mine cryptocurrency without permission. Mining is deliberately compute-heavy work, and doing it costs real money in hardware and electricity. Cryptojacking removes that cost for the attacker by pushing it onto victims, thousands of them if the operation is large.

Why attackers cryptojack

Mining cryptocurrency legitimately means buying hardware and paying for the power it burns. On a large scale, the electricity bill can eat most of the profit. Cryptojacking makes the arithmetic work by stealing both inputs. The attacker mines using other people's processors and other people's electricity, keeping the full reward.

That economic logic drives the malware's behavior. Because profit scales with how long the mining runs undetected, a cryptojacker is built to be quiet. It does not encrypt files or pop ransom notes. It tries to look like nothing at all, throttling itself if needed so the victim does not notice and clean it up. On MITRE ATT&CK this behavior maps to Resource Hijacking (T1496).

Browser-based versus host-based mining

Cryptojacking comes in two forms that differ in where the mining code lives and how long it lasts.

Browser-based mining runs inside a web page. A script embedded in a site, sometimes by the site owner, sometimes by an attacker who compromised the site or an ad it serves, uses your browser to mine while the page is open. It needs no installation. The moment you close the tab, the mining stops. The cost to you is a hot, sluggish device for as long as you stay on the page.

Host-based mining installs a mining program on the machine itself. This is more valuable to the attacker because it does not depend on you visiting a page. It installs persistence so it survives reboots, and it mines continuously in the background for as long as it goes unnoticed. Host-based miners are what land on servers, workstations, and cloud instances, and they are the ones that run up the largest bills.

The damage is indirect, which is why it hides so well

A cryptojacker usually steals no data and destroys nothing, so it slips past the mental model of what malware does. The harm is real but indirect: shortened hardware life from constant full load, higher electricity costs, degraded performance for real work, and, in the cloud, a compute bill that can climb fast. Because there is no obvious breach, infections often run for a long time before anyone investigates the slowness.

The cloud is the richest target

The largest cryptojacking payouts come from cloud and container environments, and the reason is simple: that is where the compute is. A personal laptop mines slowly. A cluster of cloud servers mines fast, and it bills the victim automatically.

Attackers get in through the usual cloud weaknesses: an exposed container-management API with no authentication, a leaked access key committed to a public repository, an over-permissioned service account, or a misconfigured storage bucket that leaks credentials. Once inside, they enumerate the environment, mapping to Cloud Infrastructure Discovery (T1580), and spin up as much mining compute as the account allows. The first sign is often the invoice.

The mining software frequently arrives packaged in an abused file format or a tampered container image, a script, an archive, a malicious installer, or a poisoned dependency. Our File-Format Abuse Atlas catalogues those delivery formats and how to detect them, which is where you can catch a miner before it starts consuming resources.

Browser versus host at a glance

Aspect	Browser-based mining	Host-based mining
Where it runs	Inside a web page in the browser	Installed on the operating system
Persistence	None; stops when the tab closes	Installs persistence to survive reboots
Duration	Only while you view the page	Continuous until detected and removed
Typical targets	Anyone visiting the affected site	Workstations, servers, cloud instances
Main tell	Device heats up on a specific site	Sustained high processor use at all times

The shared signature across both is the same: something is working your processor hard when it should be idle.

How to detect a cryptojacker

Because cryptojacking hides its damage, detection means watching resources rather than waiting for an obvious symptom.

Sustained high processor use when the device should be idle, especially processes you do not recognize pinned near full load.
Heat and fan noise on a machine that is not doing demanding work, and shortened battery life on laptops.
Sluggish performance for ordinary tasks, as mining starves real work of cycles.
Outbound connections to mining pools, visible in network monitoring as repeated traffic to mining-related destinations.
Unexpected cloud cost increases, often the first and clearest signal in cloud environments, where a sudden compute spike shows up on the bill before anywhere else.

In the cloud, usage-based alerting is the sharpest detector: an anomaly in compute consumption is hard for an attacker to hide when it maps directly to money.

How to defend against cryptojacking

Defense spans the host, the browser, the network, and the cloud, and it leans heavily on the resource monitoring that also detects it.

Patch and use application control on hosts. Many host-based miners arrive through known vulnerabilities or by running unauthorized executables. Fast patching and controlling what software is allowed to run closes both doors.
Block mining scripts in the browser and network. Browser extensions and DNS or web filtering can block known mining scripts and mining-pool domains, stopping browser-based mining and cutting off host miners that need to reach a pool.
Monitor resource use as a security signal. Baseline normal processor and cloud consumption and alert on sustained anomalies. A miner cannot hide from consumption monitoring, because consuming resources is the entire point.
Lock down cloud configuration. Require authentication on management and container APIs, never expose them to the internet, apply least privilege to service accounts, and keep access keys out of code repositories.
Set usage-based cost alerts in the cloud. An alert on abnormal compute spend turns a hidden miner into an immediate signal, often the fastest way to catch cloud cryptojacking.
Segment and limit privileges. Restrict how far an attacker who lands on one host or one cloud identity can spread, so a single foothold cannot enlist your whole fleet into mining.

Alert on the bill as well as the box

In the cloud, the most reliable cryptojacking detector is a cost or usage anomaly alert. A miner's whole purpose is to consume compute, and in a metered environment that consumption is impossible to hide from a threshold you have set. Wire the alert to your compute spend and you will often catch mining before any endpoint tool does.

Why mining is worth stealing compute for

Understanding cryptojacking starts with why mining costs anything at all. Many cryptocurrencies secure their networks with proof of work, where participants compete to solve a deliberately hard computational puzzle, and the winner earns newly issued coins and fees. The puzzle has no shortcut, so the only way to win more often is to compute more guesses, which means running more hardware for more hours. That directly consumes electricity and wears down equipment.

For a legitimate miner, those two inputs, hardware and power, are the whole cost of the business, and at scale the electricity bill can consume most of the reward. Cryptojacking rewrites that arithmetic by taking both inputs from someone else. The attacker mines using victims' processors and victims' electricity, and keeps the full reward with none of the cost. That is the entire economic engine behind the malware, and it explains every design choice it makes. The malware wants to run on as many devices as possible, for as long as possible, as quietly as possible, because reward scales with total compute time and stealth is what preserves that time.

The pooling of effort matters too. A single hijacked device would rarely win a puzzle on its own, so miners join a mining pool, where many participants combine their work and share the reward in proportion to the compute each contributed. This is why cryptojacking malware reaches out to a pool: it needs to contribute its stolen compute to a collective effort and route the proportional payout back to the attacker. That required outbound connection to a pool is also one of the clearest network signals that mining is happening.

A worked example: a leaked key becomes a mining bill

Following one cloud incident from entry to invoice shows how the pieces fit. Suppose a developer commits an access key into a public code repository by accident, buried in a configuration file. Automated scanners that watch public repositories for exactly this mistake find the key within minutes. The attacker who receives it does not need to break anything, because the key is a valid credential.

The attacker's first move is reconnaissance. Using the key, they enumerate what the account can do, which regions and services are available, and how much compute they can spin up. This mapping step corresponds to Cloud Infrastructure Discovery (T1580). If the key belongs to an over-permissioned service account, the attacker finds they can launch large amounts of compute in several regions at once.

The next move is deployment. The attacker spins up as many instances as the account permits, or launches mining containers into an exposed orchestration platform, and points them all at a mining pool. Now the victim's account is running a fleet of machines doing nothing but mining, and every one of those machines is billing the victim by the hour. The attacker keeps the mined coins and pays none of the cost.

The tell arrives on the invoice. Because the mining does not touch the victim's data and destroys nothing, no breach alarm fires. The first clear signal is a compute bill that has climbed far above normal, often noticed only at the end of a billing period. An account with usage-based cost alerting catches the spike within hours. An account without it can run the miner for weeks, and the loss is measured in the cloud spend the attacker rang up.

Detection signals in depth

Because a cryptojacker hides its damage, detection means watching the resources it consumes rather than waiting for an obvious symptom.

Sustained high processor use when idle. A miner pins the processor near full load for long stretches, including when the device should be doing nothing. An unfamiliar process holding the processor near maximum is the clearest host-level signal.
Heat, fan noise, and battery drain. Constant full load produces heat and fan activity on a machine doing no demanding work, and it shortens battery life on laptops noticeably.
Sluggish real work. Because mining consumes cycles that legitimate tasks need, ordinary operations slow down, which is often the symptom a user reports first without knowing the cause.
Outbound connections to mining pools. Miners must reach a pool to coordinate and submit work, so repeated outbound traffic to mining-related destinations shows up in network monitoring even when the process itself is hidden.
Compute cost anomalies in the cloud. A sudden rise in compute consumption is the sharpest cloud signal, because mining maps directly to metered spend that an attacker cannot hide from a threshold you have set.

The absence of damage is itself the signal

Most malware announces itself through encrypted files, stolen data, or a ransom note. A cryptojacker deliberately does none of that, so the usual alarms stay silent. The way to catch it is to invert the expectation and treat unexplained resource consumption as the symptom, because consuming resources quietly is the entire purpose of the malware.

Common misconceptions

Several beliefs cause people to overlook or underrate cryptojacking.

It is harmless because nothing is stolen. The harm is real: shortened hardware life from constant full load, higher electricity costs, degraded performance, and in the cloud a compute bill that can climb fast. The lack of stolen data is why it hides so well, and it does not make the loss small.
Closing the tab always ends it. That is true for browser-based mining, which stops when the page closes. Host-based mining installs persistence and keeps running after reboots, so closing a browser does nothing to it.
Antivirus alone will catch it. Endpoint tools catch some miners, and the most reliable detector, especially in the cloud, is resource and cost monitoring, because a miner cannot hide the consumption that is its whole reason to exist.
Only powerful machines are targets. Any device that runs code can mine, and cloud and container environments are the richest targets because that is where large-scale compute lives and where the cost bills straight to the victim.
A miner tries to spread damage fast. The opposite is true. A cryptojacker wants to stay quiet and unnoticed for as long as possible, throttling itself if needed, because every day it stays hidden is another day it earns.

How cryptojacking evolved

Cryptojacking rose to prominence when browser-based mining scripts made it trivial to turn any website visitor's processor into a miner for as long as the page stayed open. Site owners and attackers alike embedded these scripts, some disclosed and many not, and the low barrier meant the technique spread quickly across compromised sites and malicious ads. As browsers and blocklists learned to recognize and stop the well-known mining scripts, the easy browser-based era faded.

The center of gravity moved to host-based and cloud mining, where the payouts are larger and the compute is concentrated. Attackers shifted to hunting exposed container APIs, leaked keys, and misconfigured cloud services, because a single such mistake can hand over compute at a scale no personal laptop could match, with the cost billed automatically to the victim. The economic logic never changed across this evolution: mining costs money in hardware and electricity, and cryptojacking exists to push that cost onto someone else, so attackers follow wherever the cheapest stolen compute happens to be.

Cryptojacking compared to other malware

Seeing cryptojacking beside other malware classes clarifies why it behaves the way it does.

Aspect	Cryptojacker	Ransomware	Data-stealing malware
Attacker goal	Steal compute to mine coins	Extort payment	Exfiltrate valuable data
Wants to be noticed	No, quiet as long as possible	Yes, demands attention	No, but exit can be abrupt
Direct data damage	Usually none	Encrypts or destroys	Copies data out
Main victim cost	Compute, power, cloud spend	Ransom and downtime	Breach impact and exposure
Primary tell	Resource and cost anomalies	Ransom note and locked files	Unusual data flows

The row that matters most is the second one. Ransomware needs to be seen to get paid, and a cryptojacker needs to stay hidden to keep earning. That single difference in incentive is why detection relies on watching quiet resource consumption rather than waiting for a loud event.

Frequently asked questions

What exactly is a cryptojacker? It is malware that hijacks a device's computing resources to mine cryptocurrency without permission, stealing the processor cycles, electricity, and in the cloud the compute spend, and keeping the mined coins for the attacker. Its strategy is to stay hidden long enough to keep earning, which maps to Resource Hijacking (T1496).

How is browser-based mining different from host-based mining? Browser-based mining runs inside a web page and stops the moment you close the tab, needing no installation. Host-based mining installs a program on the machine, adds persistence so it survives reboots, and mines continuously until detected and removed. Host-based miners are the ones that land on servers and cloud instances and run up the largest bills.

Why is the cloud the richest target? That is where the compute is. A personal laptop mines slowly, and a cluster of cloud servers mines fast and bills the victim automatically. Attackers get in through exposed container APIs, leaked keys, over-permissioned service accounts, and misconfigurations, then spin up as much mining compute as the account allows.

How do I detect a cryptojacker? Watch resources rather than waiting for obvious damage. Look for sustained high processor use when idle, heat and fan noise, sluggish performance, outbound connections to mining pools, and in the cloud a spike in compute cost. Usage-based cost alerting is often the fastest detector because mining maps directly to metered spend.

Is cryptojacking illegal? Running mining code on someone else's device without authorization is unauthorized use of their resources and is treated as a computer misuse offense in most jurisdictions. The disclosed case, where a site owner runs mining on their own visitors with clear consent, is a separate matter from the covert malware this guide describes.

Can cryptojacking lead to worse compromises? It can be a symptom of a broader intrusion. The same exposed key or misconfiguration that let an attacker mine could let them do more, and a foothold used for mining today can be repurposed. Treat a miner as evidence that something is wrong. Investigate how it got in, and look past the resource consumption to whatever weakness let it in.

What is the single most effective defense in the cloud? Wire usage-based cost and consumption alerts to your compute spend. A miner's entire purpose is to consume compute, and in a metered environment that consumption is impossible to hide from a threshold you have set, so a cost anomaly alert often catches cloud cryptojacking before any endpoint tool does.

Does a cryptojacker slow down over time or stay constant? It behaves however it must to stay hidden. Some miners run at full load whenever the device is idle and back off the moment a user is active, so the machine feels normal in use and mines hard when unattended. Others throttle to a steady fraction of capacity to avoid the obvious symptom of a permanently maxed processor. The adaptive behavior is another reason to rely on consumption baselines rather than on how the device feels at any one moment.

Can blocking mining pool domains stop a miner? It helps significantly. A miner must reach a pool to contribute work and collect its share, so blocking known mining-pool domains through DNS or web filtering cuts off that path and neutralizes both browser-based and host-based miners that depend on reaching a pool. Combine it with resource monitoring, because a miner pointed at an unknown pool still reveals itself through consumption.

Cryptojacking that scales usually rides on the same infrastructure as botnets, with fleets of compromised devices mining in unison for one operator. The crews that run these campaigns are tracked in our Threat Groups directory, so you can connect a mining outbreak to the actor behind it.

A cryptojacker is a parasite. It does not want to be noticed, because being noticed ends the payout, so it steals quietly: your cycles, your power, your cloud spend, for as long as it can. That quiet is also its weakness. Watch your resource use and your cloud bill, block the mining scripts and pools, and keep hosts and cloud configuration tight, and a miner has nowhere left to hide.