CyberGlossary

Malware

Cryptominer

Also known as: Coin miner, Mining malware

Definition

Software that performs cryptocurrency mining; malicious variants run without consent and divert host resources to attacker-controlled wallets.

A cryptominer is any program that uses computing power to solve cryptographic puzzles in exchange for cryptocurrency rewards. Legitimate miners are installed deliberately by the owner, while malicious cryptominers are dropped by malware or injected into websites and run hidden in the background. They commonly target Monero (XMR) because of its CPU-friendly algorithm and privacy features. Indicators include persistent high CPU/GPU load, suspicious child processes, and outbound connections to known mining pools. Defences include endpoint protection with miner signatures, blocking mining-pool domains, application allow-listing, restricting script execution, and monitoring cloud workloads for unexpected compute growth.

Examples

  • XMRig binaries deployed by malware to mine Monero on victim servers.
  • Browser-based JavaScript miners that activate when a page is loaded.

Related terms