Cryptojacking Definition

Cryptojacking is the secret use of someone else’s computer, phone, or server to mine cryptocurrency without permission. It is often called malicious cryptomining because the attacker gets coins while the victim pays for the hardware wear and electricity. Successful campaigns try to stay hidden by taking small slices of power from many devices over long periods.

How it works

Attackers typically pick one of two routes. In a host-based attack, malware lands on a device through tactics like phishing or a shady download. Once inside, the code quietly redirects CPU or GPU cycles to a mining pool. In a browser-based attack, also known as drive-by cryptomining, a website runs a mining script in the visitor’s browser. Some scripts even keep running via a hidden window after the user leaves the page. In larger outbreaks, the malware can move through a network and infect more machines. 

Common entry points

Typical entry points include malicious email links or attachments, compromised websites that load mining JavaScript, and software downloads that hide a miner. All of these aim to start a script that consumes processing power without the owner noticing.

Signs to watch

Because the goal is to stay quiet, clues are mostly about performance and power use. People often notice high CPU usage, louder fans, overheating, sudden battery drain on mobile, slower apps or web pages, laggy networks, and higher electricity bills.

Risks and impact

Cryptojacking wastes energy, shortens hardware life, and cuts productivity as devices slow or crash. In companies, it can spread across many systems and create real operational costs while security teams chase the source.

Detection and prevention

Basic hygiene goes a long way: keep operating systems, browsers, and plugins updated; train teams to spot phishing; and monitor CPU, GPU, and network spikes. On the browser side, script-blocking and anti-mining extensions can stop drive-by attempts, and some organizations whitelist allowed sites or blacklist known offenders. Endpoint security suites can detect miners and remove them if they slip through.

Cryptojacking vs. legitimate mining

Legitimate miners use their own hardware and power with full consent. Cryptojacking takes those same resources from others without asking and tries to remain invisible so the attacker earns coins for free. 

Notable incidents

Documented cases include mining code found on a major newspaper’s website and on a well-known fact-checking site, as well as an attack on a European water utility. These examples showed how public sites and operational systems could be pulled into mining Monero via injected scripts.

‍