Cryptojacking.

Cryptojacking hijacks a victim's CPU, GPU, or cloud account to mine cryptocurrency — almost always Monero (XMR), because it is privacy-preserving and profitably mineable on ordinary CPUs. Three delivery styles dominate. Browser (drive-by) mining peaked with Coinhive, a JavaScript miner launched in 2017 and embedded — often without consent — into thousands of sites and malvertising chains until it shut down in March 2019. Host malware drops a miner after compromise; WannaMine and related worms spread via the EternalBlue SMB exploit. Cloud abuse is now the costliest form: in February 2018 RedLock found attackers mining inside Tesla's AWS account after reaching an unsecured Kubernetes administration console, running a custom Stratum miner tuned to hide from detection. In October 2019 Palo Alto Unit 42 documented Graboid, the first cryptojacking worm to spread through more than 2,000 unsecured Docker Engine hosts. Crews like TeamTNT and Kinsing continuously scan for exposed Docker and Kubernetes APIs to plant miners.

Because nothing is encrypted or exfiltrated, cryptojacking hides for months — the tells are sustained high CPU/GPU load, overheating, and surprise cloud bills.

flowchart TD
  A[Attacker] --> B{Access method}
  B -->|Malicious website JS| C[Victim browser mines]
  B -->|Malware dropper| D[Endpoint CPU/GPU mines]
  B -->|Stolen cloud creds / exposed API| E[Cloud instances spun up]
  C --> F[Hashes to mining pool]
  D --> F
  E --> F
  F --> G[Monero paid to attacker wallet]
  H[Defences: EDR, browser blockers,<br/>resource baselines, IAM audit] -.blocks.-> C & D & E

Defences include endpoint anti-malware and EDR, browser blockers, baselining process and resource usage, restricting outbound traffic to known mining pools, and tightly auditing cloud IAM permissions and exposed management endpoints.