Security teams should treat browser-based cryptojacking as an unwanted use of endpoint resources, not just a nuisance. The practical controls are script blocking, tighter browser extension governance, user awareness for suspicious CPU spikes, and monitoring for unusual fan noise or sustained processor load. Trusted sites are less likely to abuse mining scripts, but any site that runs arbitrary JavaScript can introduce this risk.
Why browser-based cryptojacking on unmanaged websites is a resource-abuse problem
Browser-based cryptojacking works because the page is allowed to execute JavaScript in the user’s browser. That means the practical risk is not limited to malware in the traditional sense, it is also unwanted consumption of CPU, battery, thermals, and browser stability. On unmanaged websites, the attacker does not need persistent access to the endpoint, only a way to load mining code while the page stays open.
The most important control objective is reducing the number of places where arbitrary scripts can run and limiting how much they can do if they do run. Script blocking, content filtering, and tighter extension governance matter because they reduce the chance that a page can load a miner or that an extension can silently reintroduce it. Trusted sites are lower risk, but trust is not a guarantee when third-party scripts or compromised ad supply chains are involved.
- Block or restrict high-risk script execution paths where the business can tolerate it.
- Limit browser extensions to approved use cases and review anything that can inject or rewrite page content.
- Use endpoint telemetry to spot sustained CPU load, elevated fan speed, or battery drain that aligns with browsing sessions.
How to reduce exposure without breaking normal web usage
The practical balance is to narrow script execution rather than trying to police every website manually. Organisations usually get better results from browser policy, allowlisting, and extension control than from relying on users to judge whether a site is “safe.” If unmanaged websites are part of day-to-day work, the browser itself becomes a control point, so security teams should treat it like any other managed execution surface.
Awareness still has value, but it should be specific and observable. Users are more likely to notice a laptop running hot, a fan spinning unusually fast, or a browser tab that starts consuming resources after loading an otherwise ordinary page. Those symptoms should trigger a check for extension abuse, injected scripts, or a suspicious site rather than being dismissed as routine performance noise.
At scale, organisations should watch for repeated reports from the same browser family, extension, or web property, because that pattern often points to a shared control gap rather than isolated incidents. If the same browser policy exceptions keep appearing, the problem is usually governance, not user behaviour.
Risk and Threat Considerations
Browser-based cryptojacking is attractive to attackers because it turns ordinary browsing sessions into distributed compute abuse. The main risk is silent resource theft, but the same execution path can also be used to deliver additional malicious scripts, fingerprint users, or exploit weak browser governance.
Failure mechanism: A user loads an unmanaged site that executes arbitrary JavaScript, a miner runs in the browser context, and the browser or extension layer fails to stop the script or detect the resource spike in time.
Impact: The endpoint burns CPU, battery life, and thermal headroom, which degrades performance and can mask broader web compromise, especially if the site or extension can repeatedly reintroduce the script.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS 8 - 9 — Email and Web Browser Protections | Browser script abuse is reduced by hardening browser behavior and web access controls. |
| CIS 8 - 4 — Secure Configuration of Enterprise Assets and Software | Extension governance and browser policy are secure configuration problems for endpoints. | |
| Recommendation — Restrict risky browsing behaviors and block malicious web content at the browser layer. Apply hardened browser configurations and limit unauthorized extensions. | ||
| NIST CSF 2.0 | PR.PT — Protective Technology | Script blocking and endpoint protections directly reduce web-based cryptojacking exposure. |
| DE.AE — Anomalies and Events | CPU spikes, fan noise, and sustained load are detectable anomalies for cryptojacking. | |
| Recommendation — Deploy protective technologies that limit malicious script execution and browser abuse. Monitor and triage anomalous browser-driven resource use as a security event. | ||
Practitioner Guidance
What to prioritise: Start with browser controls that reduce arbitrary script execution, then layer extension governance on top. If you can only improve one thing quickly, make sure high-risk extensions are reviewed and that users cannot self-install anything that can inject scripts or alter page behavior.
What to verify: Confirm that your telemetry can distinguish normal browsing from sustained mining-like load. The most useful signals are long-lived CPU spikes tied to specific sites, unusual fan noise reports, and repeated performance degradation on otherwise idle machines.
Practitioner takeaway: The goal is not to eliminate every risky website, it is to make browser abuse visible, harder to execute, and easier to contain before it becomes a persistent endpoint drain.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 20, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
