kryptojacking

Kryptojacking, or cryptojacking, is the unauthorized use of another party’s computing resources to mine cryptocurrency. Attackers can inject or deliver mining code that runs in a victim’s device, often without the owner’s knowledge, to earn digital coins.

There are two common forms. In browser-based kryptojacking, a script runs in the victim’s web browser after visiting a compromised site, clicking a malicious link, or loading malicious advertising, consuming CPU time and electricity. In malware-based cryptomining, malicious software is installed on the device and runs mining software in the background, potentially hiding in plain sight.

Common vectors include drive-by downloads, compromised websites or plugins, malvertising, and malicious browser extensions. Monero has frequently been favored in these attacks due to its CPU-friendly mining and privacy features, though any mineable cryptocurrency can be targeted.

Indicators of kryptojacking include unusually high CPU or GPU usage, overheating devices, reduced battery life, sluggish performance, and unexpected energy costs. In enterprise environments, indicators may appear across endpoints and servers, along with increased network or process activity related to mining software or mining pools.

Prevention and response emphasize software hygiene and layered defenses. Keep operating systems and applications updated, use security software, and employ ad blockers or script blockers to prevent malicious mining scripts. Audit and restrict browser extensions, implement network protections to block mining domains, and monitor for unusual resource usage. Organizations should employ asset inventories, endpoint protection, and application allowlists, plus user education to prevent inadvertent participation in mining schemes. Legal and ethical considerations generally prohibit unauthorized mining and can carry consequences; consent-based mining requires clear user awareness and agreement.