CyberGlossary

Malware

Cryptojacking

Also known as: Malicious cryptomining, Drive-by mining

Definition

The unauthorized use of someone else's computing resources to mine cryptocurrency, typically via malware or malicious browser scripts.

Cryptojacking hijacks a victim's CPU, GPU, or cloud account to mine cryptocurrency for the attacker. It can be delivered through binaries dropped after a compromise, malicious browser-side miners injected into websites, or by abusing stolen cloud credentials to spin up large mining workloads. Symptoms include sustained high CPU usage, overheating, sluggish performance, and unexpected cloud bills. Because no data is stolen and ransom isn't demanded, cryptojacking often goes unnoticed for long periods. Defences include endpoint anti-malware, browser blockers, monitoring of process and resource baselines, restricting outbound traffic to known mining pools, and auditing cloud IAM permissions.

Examples

  • A compromised website embedding a Monero miner that runs while visitors browse.
  • Leaked AWS keys used to spin up dozens of GPU instances for mining.

Related terms