How should security teams detect cryptojacking on a website before visitors start paying the cost?

Security teams should look for browser based mining activity by watching for unusual outbound connections, especially periodic requests to mining infrastructure, and by scanning for injected JavaScript in site content. The practical goal is to catch the code path, not just the performance symptom. Continuous monitoring matters because a compromised page can mine cryptocurrency for every visitor until the malicious script is removed.

What to look for before the slowdown becomes visible

Cryptojacking on a website is usually easier to catch by tracing the code path than by waiting for users to complain about sluggish pages. The signals that matter most are unexpected outbound requests to mining infrastructure and suspicious JavaScript that did not come from the approved build or content pipeline. That means detection has to cover both network behaviour and site content integrity.

In practice, the highest-value check is whether page assets are making periodic, patterned connections that look like mining pool traffic or other long-lived beaconing. Mining scripts often blend into normal front-end activity, so a simple performance alert is too late. Teams should also compare served scripts against the approved source of truth and look for injected code in templates, tag managers, third-party includes, and cached assets.

How the attack usually survives long enough to matter

Website cryptojacking typically persists because the malicious script is placed where it executes for every visitor, then hides inside ordinary page delivery. A compromise in the content layer, a vulnerable plugin, a poisoned third-party script, or a stolen publishing credential can all turn one web page into a distributed miner. Once that happens, the attacker benefits from other people’s browsers and electricity while the site owner absorbs the trust damage.

The detection problem is therefore broader than spotting high CPU on your own servers. Browser-based mining can avoid obvious host-level indicators, especially if the page itself is the delivery mechanism. For that reason, teams should treat script integrity, outbound traffic patterns, and third-party dependency changes as the core evidence set, not as optional extras.

Risk and Threat Considerations

Cryptojacking creates two distinct problems: direct cost to visitors and a trust failure for the site operator. The more dangerous version is the one that stays quiet, because a single injected script can keep mining across a large number of sessions before anyone notices the performance impact.

Failure mechanism: A malicious or modified JavaScript path executes in the browser, then uses outbound network connections and client resources in a pattern consistent with mining activity while evading casual visual inspection.

Impact: Visitors pay in CPU, battery, bandwidth, and degraded experience, while the organisation may face reputational harm, incident response effort, and repeated re-infection if the original injection point is not found.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	DE.CM — Security Continuous Monitoring	Detects anomalous outbound activity and script abuse on live sites.
	PR.DS — Data Security	Supports integrity of delivered web assets and injected code detection.
	PR.PT — Protective Technology	Covers safeguards that limit malicious code execution and network abuse.
Recommendation — Monitor page traffic and content changes continuously to identify cryptojacking early. Protect and verify web content integrity so malicious scripts are not silently served. Apply protective controls that block or constrain unauthorized browser-side code execution.
CIS Controls v8	8 — Audit Log Management	Logging and monitoring are needed to spot suspicious mining traffic and content changes.
	16 — Application Software Security	Website script integrity and dependency control are central to preventing injection.
	13 — Network Monitoring and Defense	Outbound mining connections are a primary detection signal for browser cryptojacking.
Recommendation — Collect and review logs that expose unusual script delivery and outbound beaconing. Verify web application code and third-party scripts before they reach production. Detect suspicious external connections that match mining or beaconing patterns.
MITRE ATT&CK	T1059.007 — Command and Scripting Interpreter: JavaScript	Browser mining commonly relies on injected JavaScript execution in the page context.
	T1071.001 — Application Layer Protocol: Web Protocols	Mining traffic often blends into normal web requests and periodic beaconing.
Recommendation — Map suspicious browser scripts to JavaScript execution techniques and hunt for injection points. Inspect web protocol patterns for recurring miner-like connections to external infrastructure.
OWASP Non-Human Identity Top 10	NHI-01 — Secrets and Credential Exposure	Website compromise often starts with exposed publishing or deployment credentials.
	NHI-03 — Privilege and Access Management	Unauthorized script changes usually depend on excessive publishing or deployment access.
Recommendation — Remove exposed credentials that could let attackers inject malicious website code. Restrict website and pipeline privileges so only approved actors can alter production scripts.

Practitioner Guidance

What to verify: Confirm that every script with execution on production pages is expected, versioned, and tied back to a known release or approved third-party dependency. If a script cannot be matched to a change record, treat it as suspicious until proven otherwise.

What to measure: Watch for repeated outbound connections to unfamiliar destinations, unusual request cadence from browser sessions, and script changes outside normal deployment windows. A good alert is one that points to a specific asset or include, not just a vague increase in page latency.

Common mistake: Teams often start with server CPU alarms and miss the browser-side compromise entirely. By the time performance drops are visible, the site may already have been mining for a long time.

Practitioner takeaway: The best cryptojacking detection strategy is to correlate content integrity with outbound behaviour, because the malicious code path is usually the earliest and most actionable evidence.