What Is Cryptojacking? How Hidden Miners Steal Resources

Cryptojacking is the unauthorized use of someone else's computer, phone, or server resources to mine cryptocurrency, without the owner's knowledge or consent, with all mined value going to the attacker rather than the victim whose electricity and hardware are actually doing the work. Unlike attacks that directly steal crypto from a wallet, cryptojacking steals a resource — processing power — over time, which often makes it slower to notice and easier for attackers to sustain undetected for extended periods.

How cryptojacking typically spreads

Malicious browser scripts. A compromised or malicious website runs mining code directly in a visitor's browser via JavaScript, using the visitor's CPU for as long as the tab or window remains open. This method largely declined after major browsers added mitigations, but variants persist on less reputable sites.

Bundled malware in downloaded software. As covered in our guide on avoiding malware in mining software, fake or cracked applications frequently bundle hidden mining scripts alongside their advertised functionality.

Compromised servers and cloud infrastructure. Attackers who gain unauthorized access to servers, cloud computing accounts, or containerized environments — often through leaked credentials, unpatched vulnerabilities, or misconfigured access controls — install mining software to exploit the compromised infrastructure's computing power, sometimes running up enormous cloud billing costs for the actual account owner.

Malicious browser extensions and mobile apps. Extensions or apps that request excessive permissions can run hidden mining processes in the background disguised as legitimate functionality.

Supply-chain and dependency attacks. Malicious packages in software dependencies, as covered in our guide on malicious npm package attacks, sometimes include mining payloads alongside credential-stealing code.

Signs your device may be cryptojacked

Symptom	What to check
Unexplained slowdown or lag	Task manager/activity monitor for unfamiliar high-CPU processes
Device running unusually hot or fan constantly active	Whether this correlates with specific browser tabs or applications open
Battery draining much faster than normal (mobile)	Recently installed apps and their permission requests
Unusually high electricity or cloud computing bill	Server/cloud account activity logs for unauthorized processes or instances
Antivirus or security software flags or is unexpectedly disabled	Recent downloads and installed software for unfamiliar entries

Detection and removal steps

1. Monitor resource usage using your operating system's built-in task manager or activity monitor, watching for consistently high CPU or GPU usage not explained by any application you're intentionally running.
2. Check browser extensions and open tabs for anything unfamiliar or recently added, removing anything you don't recognize or didn't intentionally install.
3. Run a full malware/antivirus scan using updated, reputable security software, since cryptojacking scripts are a well-known malware category that most modern security tools can detect.
4. Review recently installed software and browser extensions, uninstalling anything installed around the time symptoms began.
5. For cloud/server environments, audit access logs for unauthorized logins, review running processes and instances for anything unexpected, and rotate any credentials that may have been exposed.

Why cryptojacking persists as an attack strategy

Cryptojacking is attractive to attackers for reasons distinct from direct theft: it doesn't require the victim to hold any crypto at all, since the attacker is generating new mined value rather than stealing existing funds, and detection is often delayed since the symptoms — slowdown, heat, battery drain — have many mundane explanations unrelated to malware. At scale, infecting thousands of devices with lightweight, resource-limited mining code (throttled to avoid being too obviously disruptive) can generate meaningful cumulative value for an attacker while remaining under any individual victim's threshold for serious concern.

Prevention strategies

• Keep operating systems, browsers, and security software updated, since many cryptojacking campaigns exploit known, patchable vulnerabilities.
• Use browser extensions or built-in browser settings that block script-based mining specifically, where available.
• Download software only from official, verified sources, applying the same scrutiny covered in our guide on avoiding malicious mining software.
• Apply the principle of least privilege to cloud infrastructure access — scoped credentials and monitored access reduce the chance of an unauthorized cryptojacking deployment on your infrastructure.
• Regularly review installed browser extensions and mobile apps, removing anything unused or unrecognized.

Cryptojacking versus direct wallet theft

It's worth distinguishing cryptojacking from attacks that steal existing crypto directly from a wallet, since the defenses overlap but aren't identical. Cryptojacking targets your hardware and electricity to generate new value for the attacker; wallet-draining malware targets your private keys and seed phrases to take value you already hold. A single piece of malware can sometimes do both, which is why a full wallet security review is worth doing any time you discover cryptojacking on a device that also had wallet access, rather than assuming the two risks are unrelated.

Bottom line

Cryptojacking quietly steals your device's or server's processing power to mine crypto for an attacker's benefit, spreading through malicious scripts, bundled software, compromised infrastructure, and supply-chain attacks. Watch for unexplained slowdowns, heat, or billing spikes, keep software updated and sourced only from verified locations, and treat unusually high resource usage as worth investigating rather than dismissing as a minor annoyance.