Cryptojacking is malware that secretly uses your computers to mine cryptocurrency for someone else. Instead of encrypting your files and demanding a ransom, the attacker quietly borrows your machines' processing power and electricity — often for months — and pockets the coins. There is no dramatic moment of discovery: devices run slower, fans spin harder, power bills creep up, and nobody raises the alarm.
TL;DR
- Cryptojacking hijacks CPUs and GPUs to mine cryptocurrency for the attacker instead of stealing data.
- The symptoms are performance symptoms: slow machines, overheating, short battery life, unexplained power use.
- It usually arrives like other malware — phishing attachments, drive-by scripts on websites, or unpatched servers.
- Detection is cheap: watch CPU usage baselines, check for unknown processes, and monitor browser extensions.
- The fix combines patching, endpoint protection, script blockers and staff training that treats "my laptop is suddenly slow" as reportable.
What cryptojacking means in plain terms
Mining cryptocurrency means running calculations that verify transactions; whoever does that work earns newly issued coins. It is legitimate when you choose to do it. Cryptojacking is doing it on hardware you do not own and were never asked about.
The economics explain the crime. Cryptocurrency mining consumes electricity and computing capacity. An attacker who can shift that cost onto thousands of infected machines keeps the mining rewards and pays nothing. Unlike ransomware, which announces itself with a locked screen and a countdown, cryptojacking is designed to stay invisible for as long as possible. The attacker profits most when you never notice.
How cryptojacking actually reaches your machines
There are two delivery models in 2026, and both matter to small businesses:
File-based cryptojacking. The attacker delivers a mining program like any other malware: a phishing email with a malicious attachment, a trojanised download, or exploitation of an unpatched internet-facing server. Once installed, the miner runs in the background, often disguised under a plausible process name.
Browser-based cryptojacking. JavaScript embedded in a website starts mining the moment a visitor loads the page — no install, no file, nothing persistent on disk. The most famous in-browser miner, Coinhive, was shut down in 2019 after being widely abused, but copycat scripts still circulate, usually smuggled onto legitimate sites through ad networks or compromised plugins.
The delivery overlaps with ordinary attack paths. An attack that baits people into clicking can just as easily deliver a miner as a credential stealer — the difference is what happens after the initial compromise.
The symptoms that give it away
| Symptom | What you will see | Why it happens |
|---|---|---|
| Slower devices | Apps take longer, everything lags | The CPU is busy mining on top of normal work |
| Overheating | Fans running constantly, hot laptops | Mining pushes processors to sustained high load |
| Short battery life | Devices that used to last a day now die by afternoon | Constant computation drains power |
| Rising power costs | Office electricity use climbs with no change in headcount | Machines running at full tilt around the clock |
| Unexpected crashes | Devices freezing or shutting down | Thermal stress and resource exhaustion |
None of these symptoms proves cryptojacking — they also describe aging hardware. The pattern that does prove it is a fleet-wide change: dozens of machines slowing down in the same month, across users who never complain together.
How to detect and stop it
Detection starts with baselines. If you know what normal CPU usage looks like on your machines, you will spot the machines that never drop below 80 percent. Concretely:
- Check Task Manager or Activity Monitor on slow devices. Look for unknown processes consuming sustained CPU, and for browsers using far more processor than the open tabs justify.
- Patch internet-facing systems promptly. Most file-based miners arrive through known, fixed vulnerabilities.
- Run endpoint protection and keep it current. Modern antivirus products flag known miners and the behaviours around them.
- Block crypto-mining domains at the network layer. DNS filtering can stop devices from reaching known mining pools.
- Restrict browser extensions. Malicious extensions are a common vector for browser-based mining; allow-list what staff may install.
The people layer still matters, because staff are your distributed sensor network. A person who notices their laptop running hot is seeing something your monitoring might not. Cyber Aware's security awareness training includes the quiet attack classes alongside phishing, so "my machine is suddenly slow and hot" becomes a report to IT rather than a private frustration. The reporting habit is exactly what human risk reporting measures over time.
Cryptojacking vs ransomware: different crimes, same front door
| Cryptojacking | Ransomware | |
|---|---|---|
| Goal | Steal computing power | Extort money for decryption |
| Visibility | Designed to stay hidden | Designed to announce itself |
| Business impact | Gradual: performance, power, hardware wear | Immediate: locked systems and downtime |
| Detection | Monitoring and baselines | Usually obvious within hours |
| Delivery | Phishing, exploits, drive-by scripts | Phishing, exploits, remote access |
The shared front door is the reason the same defences cover both: patching, endpoint protection, MFA and staff who report the early signals. When you harden against one, you harden against the other.
Why cryptojacking keeps coming back
The attack follows the price of cryptocurrency. When mining certain coins becomes profitable on commodity hardware, miner malware resurges. Privacy-focused coins that mine well on ordinary CPUs are the usual choice, because the attacker wants coins that are easy to convert and hard to trace. That means the threat never fully goes away — it oscillates. The businesses that keep getting hit are the ones with unpatched servers, unrestricted extensions and no baseline monitoring, which is a good description of an unreviewed IT environment. A cyber security gap assessment shows exactly which of those gaps you have before an attacker measures them for you.
FAQ
What is cryptojacking in simple terms? It is malware that secretly uses your computers to mine cryptocurrency for the attacker. Your machines pay the electricity bill; the attacker collects the coins.
How do I know if my computer is cryptojacking? Look for sustained high CPU usage from unknown processes, a fan that never stops, a battery that suddenly lasts half as long, and a browser that runs hot with few tabs open. One device may be anything; many devices slowing together is a pattern.
Is cryptojacking dangerous, or just annoying? It is more than annoying. It degrades performance, shortens hardware life, inflates power costs and — critically — it means an attacker already has a foothold on your machines. The same foothold could later deliver something worse.
Can cryptojacking happen through a browser? Yes. In-browser mining scripts start running the moment a page loads and stop when the tab closes. They leave nothing on disk, which is why script blockers, DNS filtering and extension controls matter.
Does antivirus catch cryptojacking? Known miners, usually yes. Behaviour-based detection catches many unknown ones. Neither catches what never reaches the endpoint, which is why patching and network-level filtering are part of the fix.
One last thing
Check the CPU usage of your three slowest machines today. If any unknown process has been eating processor time for weeks, you may have found a miner — and if you have, the question shifts from "how do I stop the slowness" to "how did it get in". That second question is the one worth answering properly.