Cryptojacking is the unauthorised use of someone else’s computer, server or cloud account to mine cryptocurrency, slowing down systems and running up electricity and cloud bills.
How cryptojacking works
Attackers install a miner – very often a modified build of the open-source XMRig – that uses the victim’s CPU or GPU to mine cryptocurrency, usually Monero, whose algorithm runs well on ordinary processors. Common routes are:
- Exploiting servers – unpatched web applications, exposed Docker APIs, Kubernetes dashboards and Redis instances.
- Stolen cloud credentials – launching large numbers of powerful cloud instances billed to the victim.
- Browser mining – JavaScript miners embedded in hacked websites; the Coinhive service, active from 2017 until it shut down in 2019, was widely abused this way.
- Malware and botnets – miners bundled with pirated software or spread by botnets and worms.
MITRE ATT&CK tracks this as Resource Hijacking (T1496). Groups such as TeamTNT specialised in compromising cloud and container environments for mining.
Why cryptojacking matters
Cryptojacking is often dismissed as harmless, but it causes real costs: cloud bills of thousands of dollars, overheating and battery wear on devices, and degraded performance of business services. More importantly, a miner proves the attacker has code execution – the same access could be used to steal data or deploy ransomware.
How to protect against cryptojacking
- Monitor CPU usage and cloud spending, and alert on sudden spikes.
- Patch internet-facing services and never expose Docker or Kubernetes management APIs without authentication.
- Protect cloud keys with MFA and least privilege, and set budget alerts.
- Block connections to known mining pools and use browser extensions or ad blockers that stop mining scripts.
