Cloud Cryptojacking.

Unauthorized use of a victim's cloud compute resources to mine cryptocurrency, generating costly bills while the attacker earns the rewards. It belongs to the Cloud Security category of cybersecurity.

Unauthorized use of a victim's cloud compute resources to mine cryptocurrency, generating costly bills while the attacker earns the rewards.

Cloud cryptojacking is the abuse of compromised cloud accounts, exposed credentials, vulnerable containers, or insecure CI/CD pipelines to spin up compute resources that mine Monero or other ASIC-resistant coins. Attackers prefer large GPU or burstable instances and often deploy XMRig inside Kubernetes pods or serverless functions to blend in with legitimate workloads. The financial impact falls on the victim, who pays for the consumed CPU, GPU, and egress, sometimes accruing tens of thousands of dollars in hours. Detection relies on cost anomaly alerts, CPU saturation metrics, outbound traffic to mining pools, and CSPM rules; prevention focuses on least-privilege IAM, MFA, secret scanning, and image signing.

Defences for Cloud Cryptojacking typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Cloud crypto mining abuse, Resource-jacking.