Cryptojacking (also called malicious cryptomining or drive-by mining) is the unauthorized use of someone else's computing resources (CPU, GPU, memory, electricity) to mine cryptocurrency without the victim's knowledge or consent. Attackers secretly install mining software (malware) or inject malicious JavaScript mining scripts into websites, emails, or online ads. The victim's system resources are stolen to generate cryptocurrency—typically Monero (XMR) due to its privacy features (untraceable transactions) and CPU-mining efficiency. Cryptojacking is often described as "the invisible heist" because unlike ransomware, victims may not realize their resources are being stolen for months or years.
Market Impact: Cryptojacking incidents increased by 399% in 2023 (SonicWall Cyber Threat Report), with attackers earning an estimated $3-5 billion annually. Unlike ransomware, cryptojacking often goes undetected for extended periods (average dwell time: 30-90 days) because it doesn't lock files or display visible warnings. Victims primarily notice reduced performance, higher electricity bills, and shortened hardware lifespan.
Common targets of cryptojacking attacks:
Malicious JavaScript (WebAssembly) embedded in websites runs when users visit. No installation required. Victims see high CPU usage (often 80-100%) and fan noise. Scripts can throttle to avoid detection (mine only when idle). Coinhive (2017-2019) was the most notorious example before shutdown, but clones (CryptoLoot, CoinImp, JSEcoin) remain active.
Standalone miner executables (XMRig, XMR-Stak, Silent Miner) installed via phishing emails, drive-by downloads, software bundling (fake software updates, cracked software), or trojans. Runs persistently in background, often disguised as system processes (svchost.exe, lsass.exe, csrss.exe). Uses persistence mechanisms (registry run keys, scheduled tasks, services).
Attackers compromise cloud credentials (AWS IAM keys, Azure service principals, Google Cloud service accounts) via leaked credentials (GitHub), phishing, or exploitation of vulnerable web apps. Deploy mining workloads on expensive cloud instances (GPU instances preferred), causing massive AWS/Azure/Google Cloud bills for victims (up to $100,000+ overnight).
Malicious apps disguised as legitimate software (games, battery savers, QR scanners, PDF converters, flashlight apps) that mine cryptocurrency on smartphones. Causes rapid battery drain (full charge in 2-3 hours), overheating (40-50°C), and high CPU usage. Often submitted to official app stores but removed after discovery.
Exploiting network vulnerabilities (router compromise, ARP poisoning, DNS hijacking) to inject mining scripts into all HTTP traffic flowing through the network. Victims on public WiFi or compromised corporate networks are affected without visiting malicious sites.
Compromising Docker containers, Kubernetes clusters, or container registries with malicious images. Attackers scan for exposed Docker daemons (port 2375), Kubeflow dashboards, or vulnerable container orchestration platforms. Deploy miners as Kubernetes jobs or containers, leveraging cluster resources.
Cryptominers embedded in online advertisements (display ads, video ads) that run when users visit legitimate websites with compromised ad networks. Ad networks often distribute these ads programmatically, affecting millions of users.
// Example of browser-based cryptojacking script (Coinhive-style)
<script>
// Coinhive JavaScript miner (2017-2019)
var miner = new CoinHive.Anonymous('WALLET_ADDRESS');
miner.start();
// Modern WebAssembly miners (harder to detect)
const wasmModule = await WebAssembly.instantiateStreaming(fetch('miner.wasm'), imports);
wasmModule.instance.exports.startMining('stratum+tcp://pool.supportxmr.com:5555', 'wallet_address');
</script>
// Detected by anti-mining extensions (NoCoin, minerBlock, uBlock Origin with mining filters)
// Example of malware-based miner persistence (Windows)
// Scheduled task for miner to survive reboot
schtasks /create /tn "WindowsUpdate" /tr "C:\Users\Public\xmrig.exe" /sc onstart /ru SYSTEM
// Disguised as Windows system process in Registry
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "svchost" /t REG_SZ /d "C:\Windows\Temp\svchost.exe"
// Common mining pool connections to block (network detection)
stratum+tcp://pool.supportxmr.com:5555
stratum+tcp://pool.supportxmr.com:3333
stratum+tcp://xmr-eu1.nanopool.org:14444
stratum+tcp://mine.c3pool.com:13333
stratum+tcp://pool.minexmr.com:4444
stratum+tcp://xmr.2miners.com:2222
stratum+tcp://de.zephyr.herominers.com:1122
Most popular cryptocurrency for cryptojacking attacks. Privacy features (RingCT, stealth addresses) make transactions untraceable. CPU-mining efficiency (RandomX algorithm) works well on standard computers. ASIC-resistant design prevents specialized hardware dominance. Accounted for 85% of cryptojacking attacks in 2023.
Targeted primarily for GPU-based cryptojacking in cloud infrastructure (AWS GPU instances, gaming PCs, render farms). Ethash algorithm heavily uses GPU memory bandwidth. Less common after Ethereum transition to Proof-of-Stake (The Merge, September 2022) eliminated mining. ETH classic (ETC) still targeted occasionally.
Rarely targeted due to ASIC (Application-Specific Integrated Circuit) hardware requirements - CPU/GPU mining is inefficient (not profitable). Historically used in early cryptojacking campaigns (2013-2015) before Monero dominance. No longer profitable for cryptojacking attacks.
Emerging target for GPU-based cryptojacking operations. KawPow algorithm (ProgPoW variant) resists ASIC dominance. Popular among attackers after Ethereum's Proof-of-Stake transition. Affected cloud and gaming infrastructure.
Occasionally targeted in cryptojacking malware campaigns. Scrypt algorithm less common for cryptojacking due to memory requirements. Less profitable than Monero for CPU-based cryptojacking.
Privacy-focused coin with optional shielded transactions (zk-SNARKs). Occasionally used in cryptojacking operations targeting privacy-conscious users. Equihash algorithm (memory-hard) favors GPU mining.
Privacy coin derived from Monero. Occasionally used in cryptojacking attacks as Monero alternative when mining pools detect Monero attacks. Less common.
Understanding these tools helps security professionals detect and defend against cryptojacking attacks:
JavaScript miner that popularized browser-based cryptojacking. Provided JavaScript API for website owners to monetize visitor CPU for Monero mining. Shut down in March 2019 after profitability declined, but clones (CryptoLoot, CoinImp, JSEcoin, Minero) and open-source forks remain active. Detected by anti-mining extensions.
Coinhive alternatives and clones for Monero mining via web browsers. Used by malicious websites and compromised ad networks. Claim lower detection rates than Coinhive. Offer throttling options to avoid immediate detection (mine only when user idle).
High-performance Monero (XMR) CPU/GPU miner. Most common miner in cryptojacking malware (90% of malware-based attacks). Supports RandomX algorithm optimized for general-purpose CPUs. Features include: automatic configuration, huge pages support, mining pool backup, TLS encryption, and stealth options (hidden mining). Used by both legitimate miners and attackers.
Stealth miner designed specifically to avoid detection by antivirus, EDR, and system monitoring tools. Disguises as system processes (svchost.exe, lsass.exe), reduces priority when user activity detected, hides from Task Manager, and limits CPU usage to avoid suspicion (only mines at 60-70%). Used exclusively in malicious cryptojacking campaigns.
GPU miner for Ethereum and other coins (dual mining ETH + Decred/Siacoin). Sometimes repurposed for cryptojacking before Ethereum Proof-of-Stake transition (pre-2022). Legacy tool now, occasionally found in older cryptojacking infections.
Multi-currency miner (Monero, Aeon, Sumokoin) often used in cryptojacking campaigns. Supports CPU, GPU (AMD/NVIDIA), and pooled mining. Older codebase but still functional. Detected by anti-malware signatures.
Ethereum miner (pre-Proof-of-Stake) sometimes deployed in cloud infrastructure attacks (AWS EC2 GPU instances). Legacy tool, less active since Ethereum transition to Proof-of-Stake (September 2022).
More efficient browser-based miners using WebAssembly (binary format), harder to detect than JavaScript miners. Can achieve near-native performance (5-10x faster than JavaScript). Used in sophisticated browser-based cryptojacking campaigns. Examples: Coinhive WebAssembly version, CryptoWeb miners.
// Common cryptojacking detection indicators and IoCs
// Known mining pool domain patterns (block at network level)
*.supportxmr.com
*.nanopool.org
*.minexmr.com
*.c3pool.com
*.2miners.com
*.hashvault.pro
*.herominers.com
// Known miner process names (detect via endpoint monitoring)
xmrig.exe
minerd.exe
cpuminer.exe
stratum.exe
powershell.exe -EncodedCommand *mining*
svchost.exe (running from %Temp% or %AppData%)
lsass.exe (running from non-system directory)
// Registry persistence locations (Windows)
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\SYSTEM\CurrentControlSet\Services
// Scheduled task names (common)
WindowsUpdate, UpdateTask, ChromeUpdate, JavaUpdate, AdobeFlashUpdate, SystemMaintenance, DiskCleanup
// Network traffic patterns (detect via NIDS/Snort)
Stratum protocol patterns (mine.subscribe, stratum.subscribe)
High outbound traffic to port 4444, 5555, 13333, 14444, 2222
Regular beaconing to mining pools every 10-30 seconds
DNS queries to mining pool domains with low TTL (60-300 seconds)
// Browser miner detection (JavaScript/WebAssembly)
window.CoinHive, CoinHive.Anonymous, CryptoLoot, CoinImp
WebAssembly instantiation with 'miner' or 'stratum' in imports
Web Worker scripts with mining code
High CPU usage in browser tabs (Task Manager or chrome://system)
This demonstration simulates how cryptojacking affects system resources (CPU usage, battery, performance). Click to see the impact of unauthorized cryptomining:
This is a simulated demonstration for educational purposes. Real cryptojacking consumes actual CPU/GPU resources (70-95% usage), increases electricity bills ($20-50 per device per month), reduces battery life (50-70% shorter), causes overheating (75-85°C), and degrades hardware lifespan (CPU/GPU wear). Install anti-mining browser extensions (NoCoin, minerBlock, uBlock Origin with mining filters) and monitor system performance regularly.
Persistent high CPU usage (70-100%) even when system idle or no applications open. Task Manager shows high usage from browser tabs (browser-based miners) or suspicious processes (XMRig, random names). Multiple cores running at maximum frequency. Laptop fans constantly at high speed.
Rapid battery depletion on laptops and mobile devices (50%+ faster drain). Laptop battery life reduced from 8 hours to 3-4 hours. Mobile devices requiring charging twice daily instead of once. Caused by continuous CPU/GPU utilization for mining.
Devices running excessively hot (75-85°C CPU temperature, normal is 40-60°C). Fans constantly at maximum speed (5000+ RPM). Thermal throttling reduces CPU frequency (downclocking) causing performance loss. Hardware lifespan shortened (CPU/GPU wear, battery degradation).
Constant connections to mining pool domains (pool.supportxmr.com, nanopool.org) on ports 4444, 5555, 13333, 14444, 2222. Outbound traffic to unknown IP addresses every 10-30 seconds (beaconing). DNS queries to mining pool domains with low TTL (60-300 seconds). Use netstat, Wireshark, or NIDS to detect.
Browser extensions like NoCoin, minerBlock, AdBlock with mining blocklists detect and block mining scripts (Coinhive, CryptoLoot, CoinImp). Browser CPU usage drops significantly when extensions installed. Miners appear as blocked resources in browser console.
Suspicious processes named to look like system processes (svchost.exe running from %Temp%, not System32). High CPU usage from PowerShell (encoding mining script), rundll32.exe, or mshta.exe. Processes with random GUID names or low-reputation publishers.
Cloud infrastructure (AWS, Azure, GCP) shows unexpected compute charges, high CPU utilization metrics, and unfamiliar instances or Kubernetes pods running with GPU instances (g4dn.xlarge, p3.2xlarge) not provisioned by authorized users.
// Cryptojacking detection commands (Windows)
# Find processes with high CPU usage (>50% consistently)
wmic process where "PercentProcessorTime > 5000" get name,processid,percentprocessortime
# List all network connections to identify mining pool communication
netstat -ano | findstr "ESTABLISHED"
netstat -ano | findstr "4444\|5555\|13333\|14444\|2222"
# Find mining processes by name
tasklist | findstr /i "xmrig minerd cpuminer stratum miner"
# Find processes running from suspicious locations
wmic process get name,executablepath | findstr /i "temp\|appdata\|users"
# Check scheduled tasks (miner persistence)
schtasks /query /fo LIST /v | findstr "TaskName\|Task To Run" | findstr /i "update\|miner"
# Check registry run keys (auto-start miners)
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
// Linux cryptojacking detection
# Find processes with high CPU usage
top -c -b -n 1 | grep -E "xmrig|minerd|cpuminer|stratum"
# Check for mining pool network connections
ss -tunap | grep -E "4444|5555|13333|14444|2222"
netstat -tunap | grep -E "pool.supportxmr.com|nanopool.org|minexmr.com"
# Check cron jobs for miner persistence
crontab -l
cat /etc/crontab
ls -la /etc/cron.d/
# Find miner binaries in common locations
find / -name "*xmrig*" -o -name "*minerd*" -o -name "*cpuminer*" 2>/dev/null
Install browser extensions specifically designed to detect and block browser-based cryptominers: NoCoin, minerBlock, uBlock Origin (enable "Block mining" in filter lists), AdGuard, or Malwarebytes Browser Guard. Blocks Coinhive, CryptoLoot, CoinImp, and 100+ other mining scripts.
Use NoScript, ScriptSafe, or uMatrix extensions to control JavaScript execution on untrusted sites. Disable JavaScript by default, enable only for trusted websites. Browser-based cryptominers require JavaScript to execute.
Use modern EDR (Endpoint Detection and Response) solutions (CrowdStrike, Microsoft Defender for Endpoint, SentinelOne, Carbon Black) that detect cryptojacking behavior patterns (high CPU usage, mining pool communication, persistence installation). Enable real-time protection and behavioral analysis.
Block known mining pool domains at network level using DNS filtering (Cisco Umbrella, Cloudflare Gateway, Pi-hole) or firewall rules (FQDN filtering). Block IP ranges for mining pools. Monitor for stratum protocol traffic (pattern detection).
Implement application allowlisting to only allow approved applications to run. Prevents unauthorized miners (XMRig, minerd, cpuminer) from executing, even if downloaded. Windows AppLocker, Linux SELinux, macOS sandbox.
Monitor cloud infrastructure for unauthorized mining deployments: set budget alerts (AWS Budgets, Azure Cost Management), implement least privilege IAM policies, use GuardDuty (AWS) or Security Center (Azure) for threat detection, scan for exposed credentials in GitHub (GitHub Secret Scanning), and restrict GPU instance usage.
Principle of Least Privilege (PoLP) - users should not have admin rights for daily operations. Cryptominers require installation privileges for persistence; restricting privileges prevents unauthorized installations.
Only download software from official sources. Avoid cracked software, keygens, "free" utilities, and fake software updates (Flash, Java) that often bundle cryptominers. Use browser ad blockers to prevent malvertising.
Conduct regular security audits of endpoint devices, cloud infrastructure, and network traffic. Monitor CPU usage baselines and alert on anomalous spikes. Implement SIEM (Splunk, ELK, Sentinel) for correlation of cryptojacking indicators.
Best Practice - Layered Defense for Cryptojacking: Use browser anti-mining extensions (NoCoin, uBlock Origin with mining filters), deploy endpoint protection (EDR with behavioral detection), block mining pool domains at network level (DNS filtering), implement application allowlisting, monitor cloud infrastructure for unauthorized mining, and regularly audit system performance for high CPU usage (baseline 0-20% idle, cryptojacking 70-100% sustained). The most effective single defense is anti-mining browser extensions - they block 95%+ of browser-based cryptojacking.
Cryptojacking (unauthorized cryptocurrency mining) is illegal in all jurisdictions with severe criminal and civil penalties. Understanding legal boundaries is critical:
Cryptojacking (unauthorized cryptocurrency mining using other people's computing resources) is illegal in all jurisdictions and carries severe criminal and civil penalties:
Critical Notice: This guide is provided for educational and defensive purposes to help security professionals, system administrators, incident responders, and defenders understand cryptojacking threats for legitimate activities: protecting networks from cryptojacking, developing detection capabilities (network monitoring, EDR signatures), and conducting authorized penetration testing (with written permission).
Deploying, distributing, or facilitating cryptojacking software (browser miners, XMRig, Silent Miner) without explicit written authorization from the device owner or legal entity controlling the system is criminal activity with severe consequences: federal felony charges (CFAA, Computer Misuse Act), lengthy imprisonment (10-20 years), asset forfeiture, permanent criminal record, civil liability (victims can sue for millions), and professional sanctions. Law enforcement agencies (FBI, Secret Service, Europol, INTERPOL) actively investigate and prosecute cryptojacking operations, including cloud infrastructure attacks and botnet-driven cryptojacking campaigns.
If you suspect your system is being used for cryptojacking: Immediately run anti-malware scans (Malwarebytes, Windows Defender Offline). Check Task Manager for high CPU usage (sustained 80-100%). Install anti-mining browser extensions (NoCoin, minerBlock, uBlock Origin). Monitor network traffic for mining pool connections. For cloud infrastructure, review IAM policies for unauthorized changes and set budget alerts. Report cryptojacking to FBI IC3 (ic3.gov) and CISA (cisa.gov/report). Change compromised cloud credentials and revoke unauthorized API keys.
Free browser extensions (Chrome, Firefox, Edge) that detect and block browser-based cryptominers (Coinhive, CryptoLoot, CoinImp, JSEcoin). Open-source. Recommended by cybersecurity professionals for home users.
CISA (Cybersecurity and Infrastructure Security Agency) guidance on detecting, preventing, and responding to cryptojacking attacks including cloud compromise, browser mining, and malware-based cryptojacking.
Community-maintained YARA detection rules for XMRig and other cryptominers (process names, network patterns, configuration files). Essential for threat hunting and detection development.
Cloud security course covering cloud cryptojacking detection, cloud workload protection, and incident response for unauthorized cloud mining operations.
MITRE ATT&CK framework tactics and techniques for cryptojacking: T1496 (Resource Hijacking - cryptomining), T1029 (Scheduled Transfer), T1048 (Exfiltration Over Alternative Protocol).
Abuse.ch community-driven blocklists for malicious mining pool domains and IPs. Integrates with firewalls, DNS filters, and threat intelligence platforms.
Interactive malware analysis sandbox for executing and analyzing cryptojacking malware (XMRig, Silent Miner) in isolated environments. Essential for detection development.
Unit42 (Palo Alto Networks) threat intelligence reports on cryptojacking campaigns, new miner variants, and cloud cryptojacking trends.