What happens when a website is modified to run cryptojacking code?

When a website is modified to run cryptojacking code, every visitor’s browser can be turned into a mining engine without their knowledge. That shifts cost from the attacker to the victim, degrades device performance, and can expose the organisation to a wider breach investigation. The modification also signals that the site has been compromised, not just abused for a nuisance script.

How cryptojacking modifies the victim’s browser

Cryptojacking in a website context usually means malicious JavaScript has been inserted into the page, a third-party script chain, or a content delivery path so that mining begins as soon as the page loads. The browser becomes the execution environment, which matters because the code runs with the user’s session, device resources, and network connection, not with any visible installation prompt.

That design is what makes the abuse scalable: one compromised site can silently recruit many visitors at once, and the attacker does not need to own the endpoint. It also means the mining load may vary by device capability, page duration, and whether the browser tab stays active, which can make the behaviour harder to notice in small samples.

The compromise is often not limited to a single injected line of code. Attackers may use a tampered script tag, a malicious plugin, a compromised analytics or tag-management dependency, or a supply-chain style modification that preserves the site’s outward appearance while changing what visitors execute. That is why browser-based mining is usually treated as a website integrity problem, not just an annoyance.

What changes for the visitor and the site operator

For the visitor, the visible effect is usually degraded performance: higher CPU usage, battery drain on laptops and phones, fan noise, sluggish tabs, and sometimes thermal throttling. The browser can still function normally enough to mask the abuse, so the user may blame the device or the site’s complexity rather than suspect hidden mining.

For the site operator, the impact is broader than performance complaints. A page modified to run cryptojacking code indicates the site has been altered without authorisation, which raises questions about web application compromise, third-party script trust, credential exposure, and whether the attacker can do more than mine. Once that line is crossed, defenders generally have to treat the event as a security incident, not just a content issue.

The operational consequence is that teams need to distinguish between a one-off malicious ad or external widget and a deeper compromise of the site, its deployment pipeline, or its CMS. That distinction affects containment, because removing the visible script is not enough if the attacker still has a path to reinsert it.

Risk and Threat Considerations

Cryptojacking on a website is risky because the same injection path that adds mining code can also support broader tampering, credential theft, or persistence in the delivery chain. The immediate resource abuse may be the symptom, but the underlying issue is often loss of control over what the site serves to users.

Failure mechanism: A compromised web property, script dependency, or deployment path lets malicious code execute in every visitor browser session, turning ordinary traffic into covert compute for the attacker while hiding the compromise inside trusted page content.

Impact: Victims absorb the compute cost and performance hit, while the organisation faces incident response, reputation damage, and possible follow-on investigation if the same compromise path also exposed admin access or other site assets.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	8 — Audit Log Management	Supports verifying the web compromise path and preserving evidence.
	16 — Application Software Security	Applies because injected mining code is an application integrity failure.
Recommendation — Centralise and retain logs for page, admin, and deployment events to support containment and forensics. Harden web application delivery and review third-party script changes before they reach users.
NIST CSF 2.0	PR.DS — Data Security	Protects site content and script integrity in transit and at rest.
	DE.CM — Continuous Monitoring	Useful for detecting abnormal script behaviour and runtime abuse.
	RS.AN — Analysis	Covers incident analysis once cryptojacking indicates compromise.
Recommendation — Protect published assets and delivery paths against unauthorised modification. Monitor web assets and browser-side execution for unexpected resource abuse or script drift. Analyse the injection vector and scope before remediation removes forensic evidence.

Practitioner Guidance

What to verify: Check whether the malicious behaviour is embedded in first-party code, introduced through a third-party script, or delivered by a compromised tag manager or CMS plugin. That answer determines whether containment should focus on content removal, dependency isolation, or a wider rebuild of the delivery path.

What to prioritise: Preserve the page version, deployment artefacts, and server-side logs before making changes, because cryptojacking often disappears as soon as the site is cleaned and the original entry point becomes harder to prove. If the change touched a shared dependency or admin workflow, expand scope quickly instead of assuming the issue is isolated.

Practitioner takeaway: Treat browser-based mining as evidence that untrusted code reached your users, then validate the path that allowed it before you assume the problem is only CPU abuse.