Cryptojacking is the unauthorized use of a victim’s computing power to mine cryptocurrency. Attackers install mining software on devices, servers or cloud accounts they do not own and keep the coins it produces. CISA describes it as malicious actors hijacking the processing power of victim systems. MITRE ATT&CK classes it as a form of Resource Hijacking (T1496).

How it works

• Attackers exploit vulnerable web applications, servers or container platforms and install a miner.
• Stolen cloud credentials or exposed API keys let them start many costly compute instances.
• Malicious scripts on compromised websites can mine in visitors’ browsers while the page is open.
• The miner often hides its process name and limits CPU use to avoid notice.

Why it matters for defenders

Cryptojacking can look harmless, but it causes slow systems, higher power and cloud bills, and hardware wear. More importantly, it shows that an attacker has a working foothold that could also be used for data theft or ransomware. Signs include unexplained CPU spikes and connections to mining pools. Patching, removing exposed services and protecting cloud keys are the main defenses. Hardcoded secrets leaked in public code are a common way in, which is why monitoring for exposed secrets in code is relevant.

Sources: CISA: Defending Against Illicit Cryptocurrency Mining Activity, MITRE ATT&CK T1496: Resource Hijacking