TL;DR: Cryptojacking turns browsers, endpoints, and cloud accounts into unpaid mining infrastructure, with attackers exploiting exposed servers, weak credentials, permissive access, and container weaknesses to generate profit while victims absorb the cost, according to DigiCert. The underlying governance gap is that resource theft can hide inside normal compute usage until monitoring, least privilege, and anomaly detection fail together.
At a glance
What this is: This is an explainer on cryptojacking that shows how attackers steal CPU and cloud capacity through browser scripts, malware, and cloud account compromise.
Why it matters: It matters because IAM and cloud security teams must treat resource abuse as an identity and visibility problem, especially where weak credentials, over-permissive access, and hidden workloads let mining activity persist.
Context
Cryptojacking is the unauthorized use of computing resources to mine cryptocurrency. In cloud and browser environments, the security problem is not data theft but resource theft, which makes the abuse harder to notice because normal business systems can keep running while attacker-controlled mining quietly consumes CPU, GPU, and electricity.
For identity and access teams, the critical issue is that cloud cryptojacking usually enters through weak credentials, exposed servers, overly permissive access policies, or compromised container and orchestration paths. That makes it a governance problem as much as a malware problem, because the attacker needs usable access before mining can scale.
Browser-based cryptojacking adds a separate exposure path by executing JavaScript in a visitor's session, while malware-based cryptojacking persists on the endpoint and can spread. The article's starting point is typical for current cloud risk discussions: the same resource abuse pattern now spans web sessions, devices, and cloud control planes.
Key questions
Q: What breaks when cryptojacking is not visible in cloud environments?
A: When cloud cryptojacking is invisible, teams lose the signal that a credential or workload has been abused for spend generation rather than data theft. That delays containment, inflates bills, and lets the attacker scale mining across more instances before anyone notices. Visibility has to include resource consumption, not only logs and alerts.
Q: Why does credential theft make cryptojacking campaigns harder to contain in cloud environments?
A: Credential theft turns a simple miner deployment into broader infrastructure compromise. Once attackers recover SSH credentials, cloud keys, or other administrative secrets, they can reuse legitimate access to move laterally, hide activity, and relaunch from new hosts. In cloud and Kubernetes environments, that access often outlasts the original infection and makes containment much harder than removing the miner alone.
Q: How can security teams tell cryptojacking from normal workload spikes?
A: Teams should compare CPU, GPU, and billing patterns against approved workload behavior and look for mining-like persistence, idle-time execution, or new container deployments without business justification. The key is whether the resource use matches a known service or appears as unplanned, sustained compute demand.
Q: Should organisations treat browser cryptojacking and cloud cryptojacking the same way?
A: No. Browser cryptojacking is usually session-based and depends on injected JavaScript, while cloud cryptojacking depends on account, workload, or orchestration access that can scale spend quickly. The controls differ, but both require script integrity, identity scope reduction, and anomaly detection.
Technical breakdown
Browser-based cryptojacking through injected JavaScript
Browser-based cryptojacking works when a compromised site, malicious ad, or injected script loads JavaScript that begins mining in the user's browser. The code uses the visitor's CPU while the tab stays open, so the attack relies on active sessions rather than permanent installation. Because the mining workload looks like heavy page activity, it can evade basic signature-based detection and disappear when the session ends, which makes dwell time and user concurrency the key variables for defenders.
Practical implication: monitor web properties for script integrity, unexpected third-party code, and abnormal client-side resource use.
Malware-based cryptojacking on endpoints and servers
Malware-based cryptojacking installs a background process on a device or server and keeps running after reboots or browser closure. Attackers often arrive through phishing, malicious downloads, or bundled software, then hide the miner and tune it to run when the device is idle. This is operationally distinct from browser mining because persistence matters more than session length, and defenders need process behavior, parent-child process chains, and workload baselines rather than only file reputation.
Practical implication: use endpoint telemetry to detect hidden miners, suspicious persistence, and process patterns that spike without approved workloads.
Cloud resource theft and container abuse
Cloud cryptojacking scales because attackers can spin up many instances or deploy mining containers once they gain account or cluster access. Publicly exposed servers, weak credentials, permissive IAM roles, and container or Kubernetes weaknesses create the entry path, then the abuse shifts into billing impact and capacity exhaustion. The architectural issue is that cloud environments decouple access from physical ownership, so one compromised identity can create a large financial and operational blast radius very quickly.
Practical implication: tighten IAM scope, inspect orchestration permissions, and alert on unusual instance creation or container deployment bursts.
Threat narrative
Attacker objective: The attacker wants to convert someone else's compute capacity into unearned mining revenue while shifting infrastructure costs to the victim.
- Entry occurs when attackers use weak credentials, exposed servers, phishing, or compromised container and orchestration paths to gain access to browsers, endpoints, or cloud accounts.
- Credentialed access is then abused to deploy JavaScript, malware, or mining containers that execute in the background and consume victim compute.
- Escalation happens when the miner spreads across additional hosts or cloud resources, increasing CPU and GPU consumption while staying hidden from basic monitoring.
- Impact is realized as degraded performance, higher electricity and cloud bills, accelerated hardware wear, and unauthorized profit for the attacker.
Breaches seen in the wild
- GitHub code signing certificate theft 2022: A machine account's compromised token cloned GitHub's Desktop and Atom repos, exposing encrypted signing certificates later revoked.
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Cryptojacking is an identity and governance failure before it is a malware event. The article correctly frames the problem as unauthorized resource consumption, but the important security lesson is that attackers need control-plane access, browser execution, or persistent code execution to make the abuse profitable. That means cryptojacking should be handled as a governance issue spanning access scope, workload telemetry, and cloud cost anomaly detection. Practitioners should treat hidden compute abuse as a sign that identity controls are too permissive or too opaque.
Cloud cryptojacking exposes the identity blast radius of permissive access. A single exposed cloud account can produce a large mining footprint because cloud access is already the ability to create spend. This is why least privilege in cloud environments is not only about data protection, but about limiting the attacker's ability to turn a credential into scalable infrastructure consumption. Practitioners need to see cloud IAM as a cost-containment control as much as an access control.
Browser and endpoint cryptojacking show that modern abuse can hide in normal performance variance. Mining scripts and background miners do not need to exfiltrate data to create material harm, so teams that only look for theft or ransomware miss the signal. The named concept here is resource theft visibility gap: the failure to treat CPU, GPU, and billing anomalies as security telemetry. The implication is that detection strategy must extend beyond alerts on data movement.
Container and orchestration exposure make cryptojacking a workload identity problem. When attackers use compromised images, cluster permissions, or exposed orchestration paths, they are exploiting trust in runtime workloads rather than breaking the platform in a loud way. That aligns this threat with workload identity governance, where access is granted to machines and services that can act at scale. Practitioners should re-evaluate how much autonomous deployment capability their clusters really expose.
Cryptojacking validates why anomaly detection must sit beside access governance. Overly permissive access policies create the path, but unusual resource consumption is often the first observable effect. The discipline implication is that IAM teams, cloud security teams, and FinOps stakeholders need a shared operating model, because cloud abuse can present first as billing drift rather than a classic security incident. Practitioners should build cross-domain detection and escalation paths.
What this signals
Resource theft visibility gap: cryptojacking shows why identity programmes need telemetry for compute consumption as well as authentication and authorisation. When attackers can translate access into spend, the control failure appears first in billing and performance signals, not just security logs.
Cloud and browser cryptojacking should push practitioners to widen the boundary of identity governance. Access reviews, least privilege, and workload monitoring are no longer separate conversations when a compromised identity can become an unpaid mining engine.
The practical programme change is to connect IAM, cloud posture management, endpoint telemetry, and FinOps escalation so unusual consumption is treated as a security signal rather than a cost surprise.
For practitioners
- Tighten cloud IAM blast radius Reduce the ability of any single cloud identity to create large-scale compute spend by removing unnecessary instance creation, container deployment, and orchestration privileges.
- Baseline resource usage by workload Establish normal CPU, GPU, memory, and billing patterns for key applications so anomalous mining-style consumption is visible quickly.
- Inspect browser-delivered scripts and ads Review third-party JavaScript, ad tags, and site injection paths for unexpected compute-heavy code that can run in visitor sessions.
- Hunt for persistence on endpoints Look for background miners, suspicious startup entries, and idle-time execution on laptops, servers, and developer workstations.
- Alert on unusual container creation bursts Correlate new workloads, cluster changes, and sudden cost spikes so cryptomining containers do not blend into ordinary platform activity.
Key takeaways
- Cryptojacking is best understood as unauthorized resource appropriation, not as data theft, which is why it often stays hidden longer than more destructive attacks.
- The article ties the risk to exposed servers, weak credentials, overly permissive access, and container weaknesses, all of which expand the attacker's ability to mine at scale.
- Teams that want to reduce impact need visibility into compute consumption, tighter access scope, and faster anomaly detection across browsers, endpoints, and cloud workloads.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Cloud cryptojacking depends on identities that can create or scale compute unnecessarily. |
| NHI-06 — Insecure Cloud Deployment Configurations | The article cites exposed servers, permissive access, and container weaknesses as entry paths. | |
| Recommendation — Reduce standing privilege so cloud identities cannot provision mining capacity without explicit approval. Harden cloud deployment settings to remove exposed services and default permissions attackers exploit. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Least privilege is directly relevant to limiting compute-spend abuse through cloud identities. |
| Recommendation — Apply least privilege to restrict which identities can create instances, deploy containers, or alter workloads. | ||
| MITRE ATT&CK | TA0006; TA0003; TA0040 — Credential Access; Persistence; Impact | The article describes access paths, hidden mining persistence, and operational impact. |
| Recommendation — Map cryptojacking detections to credential access, persistence, and impact to prioritize hunting and containment. | ||
| CIS Controls v8 | CIS-5 — Account Management | Abuse begins when cloud and endpoint accounts retain more access than they need. |
| Recommendation — Review account assignments and remove access that enables unauthorized workload creation or persistence. | ||
Key terms
- Cryptojacking: Cryptojacking is the unauthorized use of someone else’s compute to mine cryptocurrency. In practice, attackers exploit browser sessions, malware, or cloud credentials to convert victim resources into mining output while avoiding hardware, power, and infrastructure costs.
- Browser-based Cryptojacking: Browser-based cryptojacking uses injected JavaScript or malicious ads to run mining code inside a visitor's browser session. It is usually temporary and session-bound, which makes page integrity and script monitoring more important than endpoint persistence checks.
- Cloud Cryptojacking: Cloud cryptojacking is the abuse of cloud accounts, workloads, or orchestration paths to run mining at scale. It is especially damaging because a single compromised identity can create many instances or containers and turn access into direct spend.
- Resource Theft Visibility Gap: A resource theft visibility gap exists when teams monitor data loss and malware signatures but do not treat abnormal CPU, GPU, or billing changes as security evidence. In cryptojacking cases, this gap delays detection because the attack manifests as consumption, not exfiltration.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 23, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org