A cryptojacking attack is the unauthorized use of a device, server, cloud workload, or browser to mine cryptocurrency for an attacker. Technically, it usually relies on malware, stolen credentials, or compromised scripts that consume CPU, memory, and power, while hiding activity to avoid detection and degrade performance.
What Cryptojacking Means in Practice
Cryptojacking is not just “someone mining coins on your systems”; it is resource theft. The attacker turns your CPU, memory, storage, or browser session into part of a mining operation, and the victim usually pays the cost through slower performance, higher cloud bills, and reduced availability.
Because the activity is intentionally noisy at the resource level, cryptojacking often succeeds by blending into normal workloads or by using low-and-slow execution. That makes it especially useful for attackers who want long-lived, monetisable access without immediately breaking the target.
How Cryptojacking Commonly Starts
Most cryptojacking campaigns begin with one of three access paths: malware on an endpoint or server, stolen credentials that reach a cloud console or workload, or compromised scripts loaded into a browser or web application. The attack is often opportunistic rather than targeted, but exposed services and weak hygiene make it much easier to scale.
In cloud and container environments, the problem is frequently not the miner itself but the access path that makes deployment possible. A weakly protected host, a leaked key, or an exposed management surface can give an attacker enough reach to launch mining containers, abuse compute quotas, or pivot into other assets.
Why Cryptojacking Is Dangerous
Cryptojacking can degrade service quality, trigger autoscaling or cloud spend spikes, and hide a more serious compromise. A miner is often the visible payload, but the real problem is that the attacker has already obtained execution or access on systems that should have been trusted.
It also creates operational blind spots. When teams dismiss elevated resource use as “just mining,” they can miss credential theft, lateral movement, or additional malware living alongside the miner. In practice, cryptojacking is often a symptom of broader compromise rather than a standalone nuisance.
How Teams Detect and Contain It
Detection usually starts with resource anomalies, such as sustained CPU spikes, unexpected GPU use, unusual process trees, or outbound traffic to mining pools. In cloud environments, billing anomalies, sudden autoscaling, and unusual container churn are often the first clues that a workload has been hijacked.
Containment should focus on cutting off execution paths, not just killing the miner process. If the attacker still has valid credentials, a writable deployment path, or a foothold in a browser or script supply chain, the mining activity can return quickly after cleanup.
- Anthropic, first AI-orchestrated cyber espionage campaign report
- CISA cyber threat advisories
- MITRE ATT&CK Enterprise Matrix
Risk and Threat Considerations
Cryptojacking is risky because it combines monetisation with stealth. Attackers benefit from long dwell time, while defenders absorb the cost in compute, availability, and incident response effort. In cloud and container estates, that cost can grow quickly when the attacker scales mining across many workloads.
Failure mechanism: An exposed service, stolen credential, malicious script, or vulnerable host grants execution, then the attacker hides mining activity behind legitimate resource consumption and keeps the foothold alive.
Impact: Organisations can see degraded performance, inflated cloud spend, and missed signs of broader compromise, including stolen keys, additional malware, or further lateral movement.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1496 — Resource Hijacking | Cryptojacking is a resource-hijacking technique that abuses compute for mining. |
| Recommendation — Map mining activity to T1496 and hunt for abnormal compute consumption across hosts and workloads. | ||
| NIST CSF 2.0 | DE.CM-09 — Malicious Code Detection | Cryptojacking commonly depends on malware or injected scripts that defenders must detect. |
| PR.AA-05 — Least Privilege and Permissions Management | Stolen or overbroad access often enables miners to run in cloud and workload environments. | |
| DE.CM-01 — Network Monitoring | Cryptojacking often reveals itself through mining-pool traffic and unusual egress patterns. | |
| Recommendation — Monitor for malicious code indicators in endpoints, servers, containers, and browsers. Enforce least privilege to reduce the reach of compromised credentials and deployment paths. Baseline and alert on outbound connections that match mining behaviour or unexpected destinations. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Logs and telemetry are essential for identifying the access path and scope of mining activity. |
| Recommendation — Centralise logs so you can trace execution, credential use, and persistence during investigation. | ||
Practitioner Guidance
Why practitioners should care: Cryptojacking is often a control failure signal, not just a cost issue. If mining can run undetected, the surrounding environment usually has gaps in asset visibility, workload hardening, or credential hygiene.
What to watch for: Focus on recurring resource spikes, new outbound mining traffic, suspicious container or browser activity, and cloud billing changes that do not match normal business demand. Treat persistent mining as a prompt to review access paths and rotated secrets, not as a one-step cleanup.